Slashdot Mirror
OpenBSD Disables Intel CPU Hyper-Threading Due To Security Concerns (bleepingcomputer.com)
The OpenBSD project announced today plans to disable support for Intel CPU hyper-threading due to security concerns regarding the theoretical threat of more "Spectre-class bugs." Bleeping Computer reports: Hyper-threading (HT) is Intel's proprietary implementation of Simultaneous Multithreading (SMT), a technology that allows processors to run parallel operations on different cores of the same multi-core CPU. The feature has been added to all Intel CPUs released since 2002 and has come enabled by default, with Intel citing its performance boost as the main reason for its inclusion.
But today, Mark Kettenis of the OpenBSD project, said the OpenBSD team was removing support for Intel HT because, by design, this technology just opens the door for more timing attacks. Timing attacks are a class of cryptographic attacks through which a third-party observer can deduce the content of encrypted data by recording and analyzing the time taken to execute cryptographic algorithms. The OpenBSD team is now stepping in to provide a new setting to disable HT support because "many modern machines no longer provide the ability to disable hyper-threading in the BIOS setup."
But today, Mark Kettenis of the OpenBSD project, said the OpenBSD team was removing support for Intel HT because, by design, this technology just opens the door for more timing attacks. Timing attacks are a class of cryptographic attacks through which a third-party observer can deduce the content of encrypted data by recording and analyzing the time taken to execute cryptographic algorithms. The OpenBSD team is now stepping in to provide a new setting to disable HT support because "many modern machines no longer provide the ability to disable hyper-threading in the BIOS setup."
Given the class of Spectre and Meltdown attacks rely on someone else having the freedom to execute code on your hardware, shouldn't something like this be opt-in? There's a whole world of servers out that where Spectre is ultimately completely irrelevant in terms of a security threat, but hyperthreading is definitely not irrelevant in terms of performance.
In an interview, Theo de Raadt stated that other measures were considered by OpenBSD to fight the threats posed by Spectre, Meltdown and the new line of harmful code. "There will for sure be a trade-off between cutting edge performance and real security", de Raadt said.
One of the poweful options considered - that would permanently repel all current threats but didn't make it into final release, was making the power supply option off by default.
"a technology that allows processors to run parallel operations on different cores of the same multi-core CPU"
Not it's not. It's a technology that allows processors to present a single physical core as two logical cores. Two threads of software can run simultaneously on a single physical core.
It's mostly an optimization of the execution pipeline. When execution in one thread stalls, it can pick up processing in the other thread. It typically boosts performance by about 10-20%. And yes, I can see this could cause problems regarding timing if you can cause a pipeline stall based on a condition you want to test in the other thread on the same core. It'll be hard though. Maybe too hard to justify disabling HT altogether. Providing a switch to turn it off in case an exploit is discovered would be more wise I think.
This is your sig. There are thousands more, but this one is yours.
For some of the recent vulnerabilities, the OpenBSD team, unlike other OS vendors was not informed in advance. So even when one assumes that there is a SpectreNG-variant that uses Hyperthreading, it is not so obvious that it is known to the OpenBSD developers.
On the other hand, knowing that there are more SpectreNG-variants, and not having been informed about the details might make the OpenBSD devlopers even more cautious about any hardware feature that looks suspicious.
The general idea behind these flaws is that one process can flush the cache that another process is using, and testing whether the flushed area is free. By measuring the amount of time these flush/reload operations take, one can determine most or all of the bits of the secret signing exponent or private key when it's being used in the square-and-multiply algorithm, for example.
The attacker needs to be on the same machine. However, the main point is that any attacker program doesn't need elevated priveleges to carry out the timing attack since the attacking process will have access to the same cache that a sensitive program is using. Therefore, any seemingly legitimate program that is currently running could have this attack embedded inside it.
An attack on GnuPG can be mitigated by modifying the square and multiply algorithm, for example, so that it always multiplies. However, cryptographic attacks aren't the only problem - potentially, timing attacks can be carried out on all kinds of software as they slowly leak data.
"What lies behind us, and what lies before us are tiny matters compared to what lies within us." Ralph Waldo Emerson
First of all, it surely looks like OpenBSD developers don't even have a working spellchecker and perhaps they are correct, saying that it doesn't necessarily have a "posive" effect.
However, in all seriousness, I've seen at least two dozens tests of HT and in the worst case scenario it slows down your performance by less than a few percents, however, when we're talking servers, which nowadays run highly parallelized workloads where a single process may span several cores (nginx, mariadb, redis, mongodb, etc. etc. etc.) the performance gain from using HT may reach up to 30%, i.e. you're getting a third of your cores for free, which allows you to greatly cut expenditures and save on cooling.
Yes, HT poses security challenges in a multiuser environment (say, for a hosting provider) where people might run any code they want, however a typical application server almost always runs a tightly controlled software stack, which means your server processes cannot run any foreign code, which means Meltdown/Spectre class attacks might be safely disregarded.
iPhone users:
Settings > General > Keyboard ... set "Smart Punctuation" to Off.
You're killing us with this shit, it's unreadable.
The current release of OpenBSD, version 6.3, has issued a total of 10 patches against base since release on April 15th. Four of these are security-related, and six are reliability bug fixes.
Oracle / Red Hat Linux in that time has issued 50 security-related patches, and hundreds more that are classed as bug fixes or enhancements.
Linux is strong because it scales up and down very well, it exploits CPU features for speed to make applications run very fast, it is friendly to new features, and it has the most market share in the POSIX realm. Linux is weak because it has sacrificed security for speed in many cases, and we have Dirty Cow, Towelroot, and many similar problems in userspace - this makes Linux a bad choice for systems that will not receive patches (i.e. phones, IoT devices, embedded systems, etc.).
OpenBSD prioritizes security over speed and flexibility. It does not implement fine-grained SMP due to security concerns, and has a "big kernel lock" that Linux left behind in 2.2. It ignores many well-known standards (i.e. NFSv4). There are many things that you cannot do on OpenBSD, but what you can do is magnitudes safer than Linux.
Android politely stole OpenBSD's entire libc implementation (and then ignored it for several years), and IIRC the OpenBSD code is the largest contribution outside of the kernel itself.
OpenBSD is also the home of OpenSSH, which itself is quite secure.
I trust the opinions of the OpenBSD kernel architects, and I will look forward to their patch.