Intel's Hyper-Threading may be useful for enhancing performance, but it may also compromise security in some cases, particularly in case of servers, claims a researcher from Canada. Fortunately, it seems that patches for operating systems can correct the issue.

On Intel Pentium 4 with Hyper-Threading processor the two threads being executed on each processor share more than the execution units, but also they share access to the memory caches. Caches have already been demonstrated to be cryptographically dangerous: many implementations of AES are subject to timing attacks arising from the non-constancy of S-box lookup timings. However, having caches shared between threads provides a vastly more dangerous avenue of attack, claims Colin Percival, a researcher who has spent about half a year investigating the matter.

According to a document released Friday, this shared access to memory caches pro-vides not only an easily used high bandwidth covert channel between threads, but also permits a malicious thread (operating, in theory, with limited privileges) to monitor the execution of another thread, allowing in many cases for theft of cryptographic keys.

The security flaw hardly affects desktop users, but server administrators should pay attention to the situation. It is also unclear whether sharing of memory caches between threads may confront security within systems running dual-core processors.

The author provides some suggestions to processor designers, operating system vendors, and the authors of cryptographic software, of how this attack could be mitigated or eliminated entirely.

Intel's reaction on the allegations was unavailable at press time.

Related news

• Intel Confirms "Second-Generation" Dual-Core Chips for Late 2006.
  Intel's Merom, Conroe to Emerge Late Next Year
• Intel Confirms Quad-Core Chips in 2007, Adds New Server Chip to Roadmap.
  Intel Inserts Woodcrest Processor into Prospective Plan
• Majority of Shipped Processors to be Dual-Core by 2007, Gartner Says.
  Research Company Believes Dual-Core Chips to Represent Bulk of the Market in Two Years
• Intel Corp.'s Pentium Extreme Edition 840 Dual-Core Chips Available Now.
  Alienware, Dell, Velocity Micro Start Selling PCs Running Intel Dual-Core CPUs
• AMD, Intel Ship Dual-Core Processors [UPDATED].
  Dual-Core Microprocessors Availability Imminent
• Intel's Dual-Core Chips May Be in Days from Introduction.
  Dell Claims It Will Introduce Dual-Core Pentium Systems in the ?Coming Weeks?
• Computer Maker Preps Systems with Dual-Core Pentium Chips for Late Q2.
  Firm Unveils Intel Pentium Dual-Core PCs, while Intel Gives Industry a Glimpse at Dual-Core Chips