Multiple Vendor Hyper-Threading Technology Information Disclosure Vulnerability
BID:12724
Info
Multiple Vendor Hyper-Threading Technology Information Disclosure Vulnerability
| Bugtraq ID: | 12724 |
| Class: | Design Error |
| CVE: |
CVE-2005-0109 |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 04 2005 12:00AM |
| Updated: | Mar 09 2007 05:45PM |
| Credit: | Discovery is credited to Colin Percival. |
| Vulnerable: |
Ubuntu Ubuntu Linux 5.0 4 powerpc Ubuntu Ubuntu Linux 5.0 4 i386 Ubuntu Ubuntu Linux 5.0 4 amd64 Ubuntu Ubuntu Linux 4.1 ppc Ubuntu Ubuntu Linux 4.1 ia64 Ubuntu Ubuntu Linux 4.1 ia32 Turbolinux Turbolinux Workstation 8.0 Turbolinux Turbolinux Workstation 7.0 Turbolinux Turbolinux Server 8.0 Turbolinux Turbolinux Server 7.0 Turbolinux Turbolinux Desktop 10.0 Turbolinux Turbolinux 10 F... Turbolinux Home Turbolinux Appliance Server Workgroup Edition 1.0 Turbolinux Appliance Server Hosting Edition 1.0 Turbolinux Appliance Server 1.0 Workgroup Edition Turbolinux Appliance Server 1.0 Hosting Edition Trustix Secure Linux 2.2 Trustix Secure Linux 2.1 Trustix Secure Enterprise Linux 2.0 Sun Solaris 9_x86 Update 2 Sun Solaris 9_x86 Sun Solaris 8_x86 Sun Solaris 7.0_x86 Sun Solaris 10 SGI ProPack 3.0 SGI Advanced Linux Environment 3.0 SCO Unixware 7.1.4 SCO Unixware 7.1.3 up SCO Unixware 7.1.3 SCO Open Server 5.0.7 Redhat Linux 9.0 i386 Redhat Linux 7.3 i386 Redhat Fedora Core3 Redhat Fedora Core2 Redhat Fedora Core1 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Redhat Desktop 4.0 Redhat Desktop 3.0 NetBSD NetBSD 2.0.2 NetBSD NetBSD 2.0.1 NetBSD NetBSD 2.0 NetBSD NetBSD Current Mandriva Linux Mandrake 10.2 x86_64 Mandriva Linux Mandrake 10.2 Mandriva Linux Mandrake 10.1 x86_64 Mandriva Linux Mandrake 10.1 Mandriva Linux Mandrake 10.0 AMD64 Mandriva Linux Mandrake 10.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 2.1 x86_64 MandrakeSoft Corporate Server 2.1 IBM Hardware Management Console (HMC) for pSeries 5.0 R1.0 IBM Hardware Management Console (HMC) for pSeries 4.0 R5.0 IBM Hardware Management Console (HMC) for pSeries 4.0 R4.0 IBM Hardware Management Console (HMC) for pSeries 4.0 R3.3 IBM Hardware Management Console (HMC) for pSeries 4.0 R3.2 IBM Hardware Management Console (HMC) for pSeries 4.0 R3.1 IBM Hardware Management Console (HMC) for pSeries 4.0 R2.1 IBM Hardware Management Console (HMC) for pSeries 4.0 R2.0 IBM Hardware Management Console (HMC) for pSeries 3.3.2 IBM Hardware Management Console (HMC) for pSeries 3.0 R3.6 IBM Hardware Management Console (HMC) for pSeries 4 IBM Hardware Management Console (HMC) for pSeries 3 IBM Hardware Management Console (HMC) for iSeries 5.0 R1.0 IBM Hardware Management Console (HMC) for iSeries 4.0 R5.0 IBM Hardware Management Console (HMC) for iSeries 4.0 R4.0 IBM Hardware Management Console (HMC) for iSeries 4.0 R3.3 IBM Hardware Management Console (HMC) for iSeries 4.0 R3.2 IBM Hardware Management Console (HMC) for iSeries 4.0 R3.1 IBM Hardware Management Console (HMC) for iSeries 4.0 R2.1 IBM Hardware Management Console (HMC) for iSeries 4.0 R2.0 IBM Hardware Management Console (HMC) for iSeries 4.0 IBM Hardware Management Console (HMC) for iSeries 3.3.2 IBM Hardware Management Console (HMC) for iSeries 3.0 R3.6 FreeBSD FreeBSD 5.4 -RELEASE FreeBSD FreeBSD 5.4 -PRERELEASE FreeBSD FreeBSD 5.3 -STABLE FreeBSD FreeBSD 5.3 -RELENG FreeBSD FreeBSD 5.3 -RELEASE FreeBSD FreeBSD 5.3 FreeBSD FreeBSD 5.2.1 -RELEASE FreeBSD FreeBSD 5.2 -RELENG FreeBSD FreeBSD 5.2 -RELEASE FreeBSD FreeBSD 5.2 FreeBSD FreeBSD 5.1 -RELENG FreeBSD FreeBSD 5.1 -RELEASE/Alpha FreeBSD FreeBSD 5.1 -RELEASE-p5 FreeBSD FreeBSD 5.1 -RELEASE FreeBSD FreeBSD 5.1 FreeBSD FreeBSD 5.0 -RELENG FreeBSD FreeBSD 5.0 -RELEASE-p14 FreeBSD FreeBSD 5.0 alpha FreeBSD FreeBSD 5.0 FreeBSD FreeBSD 4.11 -STABLE FreeBSD FreeBSD 4.11 -RELENG FreeBSD FreeBSD 4.11 -RELEASE-p3 FreeBSD FreeBSD 4.10 -RELENG FreeBSD FreeBSD 4.10 -RELEASE-p8 FreeBSD FreeBSD 4.10 -RELEASE FreeBSD FreeBSD 4.10 FreeBSD FreeBSD 4.9 -RELENG FreeBSD FreeBSD 4.9 -PRERELEASE FreeBSD FreeBSD 4.9 FreeBSD FreeBSD 4.8 -RELENG FreeBSD FreeBSD 4.8 -RELEASE-p7 FreeBSD FreeBSD 4.8 -PRERELEASE FreeBSD FreeBSD 4.8 FreeBSD FreeBSD 4.7 -STABLE FreeBSD FreeBSD 4.7 -RELENG FreeBSD FreeBSD 4.7 -RELEASE-p17 FreeBSD FreeBSD 4.7 -RELEASE FreeBSD FreeBSD 4.7 FreeBSD FreeBSD 4.6.2 FreeBSD FreeBSD 4.6 -STABLE FreeBSD FreeBSD 4.6 -RELENG FreeBSD FreeBSD 4.6 -RELEASE-p20 FreeBSD FreeBSD 4.6 -RELEASE FreeBSD FreeBSD 4.6 FreeBSD FreeBSD 4.5 -STABLEpre2002-03-07 FreeBSD FreeBSD 4.5 -STABLE FreeBSD FreeBSD 4.5 -RELENG FreeBSD FreeBSD 4.5 -RELEASE-p32 FreeBSD FreeBSD 4.5 -RELEASE FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 -STABLE FreeBSD FreeBSD 4.4 -RELENG FreeBSD FreeBSD 4.4 -RELENG FreeBSD FreeBSD 4.4 -RELEASE-p42 FreeBSD FreeBSD 4.4 FreeBSD FreeBSD 4.3 -STABLE FreeBSD FreeBSD 4.3 -RELENG FreeBSD FreeBSD 4.3 -RELEASE-p38 FreeBSD FreeBSD 4.3 -RELEASE FreeBSD FreeBSD 4.3 FreeBSD FreeBSD 4.2 -STABLEpre122300 FreeBSD FreeBSD 4.2 -STABLEpre050201 FreeBSD FreeBSD 4.2 -STABLE FreeBSD FreeBSD 4.2 -RELEASE FreeBSD FreeBSD 4.2 FreeBSD FreeBSD 4.1.1 -STABLE FreeBSD FreeBSD 4.1.1 -RELEASE FreeBSD FreeBSD 4.1.1 FreeBSD FreeBSD 4.1 FreeBSD FreeBSD 4.0 .x FreeBSD FreeBSD 4.0 -RELENG FreeBSD FreeBSD 4.0 alpha FreeBSD FreeBSD 4.0 FreeBSD FreeBSD 3.5.1 -STABLEpre2001-07-20 FreeBSD FreeBSD 3.5.1 -STABLE FreeBSD FreeBSD 3.5.1 -RELEASE FreeBSD FreeBSD 3.5.1 FreeBSD FreeBSD 3.5 x FreeBSD FreeBSD 3.5 -STABLEpre122300 FreeBSD FreeBSD 3.5 -STABLEpre050201 FreeBSD FreeBSD 3.5 -STABLE FreeBSD FreeBSD 3.5 FreeBSD FreeBSD 3.4 x FreeBSD FreeBSD 3.4 FreeBSD FreeBSD 3.3 x FreeBSD FreeBSD 3.3 FreeBSD FreeBSD 3.2 x FreeBSD FreeBSD 3.2 FreeBSD FreeBSD 3.1 x FreeBSD FreeBSD 3.1 FreeBSD FreeBSD 3.0 -RELENG FreeBSD FreeBSD 3.0 FreeBSD FreeBSD 2.2.8 FreeBSD FreeBSD 2.2.6 FreeBSD FreeBSD 2.2.5 FreeBSD FreeBSD 2.2.4 FreeBSD FreeBSD 2.2.3 FreeBSD FreeBSD 2.2.2 FreeBSD FreeBSD 2.2 x FreeBSD FreeBSD 2.2 FreeBSD FreeBSD 2.1.7 .1 FreeBSD FreeBSD 2.1.6 .1 FreeBSD FreeBSD 2.1.6 FreeBSD FreeBSD 2.1.5 FreeBSD FreeBSD 2.1 x FreeBSD FreeBSD 2.1 FreeBSD FreeBSD 2.0.5 FreeBSD FreeBSD 2.0 FreeBSD FreeBSD 1.1.5 .1 FreeBSD FreeBSD 4.10-PRERELEASE FreeBSD FreeBSD 3.x FreeBSD FreeBSD 2.x |
| Not Vulnerable: | |
Discussion
Multiple Vendor Hyper-Threading Technology Information Disclosure Vulnerability
Multiple vendors' Hyper-Threading (HT) technology offerings are prone to an information-disclosure vulnerability when running on HT processors. This issue is due to the shared-memory cache associated with the virtual CPUs in an HT-capable CPU.
Exploiting this vulnerability allows local attackers to obtain sensitive information that can lead to privilege escalation.
The issue affects certain operating systems when running on HT-enabled processors. The operating systems must be running with multiprocessing enabled for this vulnerability to be exploitable. True dual-core CPUs that do not share caches across CPUs are likely not affected by this issue.
This issue was also documented in BID 13614, which has been retired.
Multiple vendors' Hyper-Threading (HT) technology offerings are prone to an information-disclosure vulnerability when running on HT processors. This issue is due to the shared-memory cache associated with the virtual CPUs in an HT-capable CPU.
Exploiting this vulnerability allows local attackers to obtain sensitive information that can lead to privilege escalation.
The issue affects certain operating systems when running on HT-enabled processors. The operating systems must be running with multiprocessing enabled for this vulnerability to be exploitable. True dual-core CPUs that do not share caches across CPUs are likely not affected by this issue.
This issue was also documented in BID 13614, which has been retired.
Exploit / POC
Multiple Vendor Hyper-Threading Technology Information Disclosure Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution / Fix
Multiple Vendor Hyper-Threading Technology Information Disclosure Vulnerability
Solution:
Please see the referenced advisories for more information.
Turbolinux Appliance Server 1.0 Workgroup Edition
Mandriva Linux Mandrake 10.0 AMD64
Turbolinux Turbolinux Desktop 10.0
Mandriva Linux Mandrake 10.1 x86_64
MandrakeSoft Corporate Server 2.1 x86_64
MandrakeSoft Corporate Server 2.1
MandrakeSoft Corporate Server 3.0
FreeBSD FreeBSD 4.11 -RELEASE-p3
FreeBSD FreeBSD 5.3
Turbolinux Turbolinux Workstation 7.0
Solution:
Please see the referenced advisories for more information.
Turbolinux Appliance Server 1.0 Workgroup Edition
-
Turbolinux openssl-0.9.6m-3.i586.rpm
Turbolinux Appliance Server 1.0 Workgroup Edition
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/ -
Turbolinux openssl-devel-0.9.6m-3.i586.rpm
Turbolinux Appliance Server 1.0 Workgroup Edition
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/
Mandriva Linux Mandrake 10.0 AMD64
-
Mandriva lib64openssl0.9.7-0.9.7c-3.2.100mdk.amd64.rpm
Mandrakelinux 10.0/AMD64:
http://www.mandriva.com/en/download -
Mandriva lib64openssl0.9.7-devel-0.9.7c-3.2.100mdk.amd64.rpm
Mandrakelinux 10.0/AMD64:
http://www.mandriva.com/en/download -
Mandriva lib64openssl0.9.7-static-devel-0.9.7c-3.2.100mdk.amd64.rpm
Mandrakelinux 10.0/AMD64:
http://www.mandriva.com/en/download -
Mandriva openssl-0.9.7c-3.2.100mdk.amd64.rpm
Mandrakelinux 10.0/AMD64:
http://www.mandriva.com/en/download -
Mandriva openssl-0.9.7c-3.2.100mdk.src.rpm
Mandrakelinux 10.0/AMD64:
http://www.mandriva.com/en/download
Turbolinux Turbolinux Desktop 10.0
-
Turbolinux openssl-0.9.7d-4.i586.rpm
Turbolinux 10 Desktop, Turbolinux 10 F..., Turbolinux Home
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/u pdates/RPMS/openssl-0.9.7d-4.i586.rpm -
Turbolinux openssl-compat-0.9.6m-7.i586.rpm
Turbolinux 10 Desktop, Turbolinux 10 F..., Turbolinux Home
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/u pdates/RPMS/openssl-compat-0.9.6m-7.i586.rpm -
Turbolinux openssl-devel-0.9.7d-4.i586.rpm
Turbolinux 10 Desktop, Turbolinux 10 F..., Turbolinux Home
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/u pdates/RPMS/openssl-devel-0.9.7d-4.i586.rpm
Mandriva Linux Mandrake 10.1 x86_64
-
Mandriva lib64openssl0.9.7-0.9.7d-1.2.101mdk.x86_64.rpm
Mandrakelinux 10.1/X86_64:
http://www.mandriva.com/en/download -
Mandriva lib64openssl0.9.7-devel-0.9.7d-1.2.101mdk.x86_64.rpm
Mandrakelinux 10.1/X86_64:
http://www.mandriva.com/en/download -
Mandriva lib64openssl0.9.7-static-devel-0.9.7d-1.2.101mdk.x86_64.rpm
Mandrakelinux 10.1/X86_64:
http://www.mandriva.com/en/download -
Mandriva openssl-0.9.7d-1.2.101mdk.src.rpm
Mandrakelinux 10.1/X86_64:
http://www.mandriva.com/en/download -
Mandriva openssl-0.9.7d-1.2.101mdk.x86_64.rpm
Mandrakelinux 10.1/X86_64:
http://www.mandriva.com/en/download
MandrakeSoft Corporate Server 2.1 x86_64
-
Mandriva libopenssl0-0.9.6i-1.9.C21mdk.x86_64.rpm
Corporate Server 2.1/X86_64:
http://www.mandriva.com/en/download -
Mandriva libopenssl0-devel-0.9.6i-1.9.C21mdk.x86_64.rpm
Corporate Server 2.1/X86_64:
http://www.mandriva.com/en/download -
Mandriva libopenssl0-static-devel-0.9.6i-1.9.C21mdk.x86_64.rpm
Corporate Server 2.1/X86_64:
http://www.mandriva.com/en/download -
Mandriva openssl-0.9.6i-1.9.C21mdk.src.rpm
Corporate Server 2.1/X86_64:
http://www.mandriva.com/en/download -
Mandriva openssl-0.9.6i-1.9.C21mdk.x86_64.rpm
Corporate Server 2.1/X86_64:
http://www.mandriva.com/en/download
MandrakeSoft Corporate Server 2.1
-
Mandriva libopenssl0-0.9.6i-1.9.C21mdk.i586.rpm
Corporate Server 2.1:
http://www.mandriva.com/en/download -
Mandriva libopenssl0-devel-0.9.6i-1.9.C21mdk.i586.rpm
Corporate Server 2.1:
http://www.mandriva.com/en/download -
Mandriva libopenssl0-static-devel-0.9.6i-1.9.C21mdk.i586.rpm
Corporate Server 2.1:
http://www.mandriva.com/en/download -
Mandriva openssl-0.9.6i-1.9.C21mdk.i586.rpm
Corporate Server 2.1:
http://www.mandriva.com/en/download -
Mandriva openssl-0.9.6i-1.9.C21mdk.src.rpm
Corporate Server 2.1:
http://www.mandriva.com/en/download
MandrakeSoft Corporate Server 3.0
-
Mandriva libopenssl0.9.7-0.9.7c-3.2.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva libopenssl0.9.7-devel-0.9.7c-3.2.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva libopenssl0.9.7-static-devel-0.9.7c-3.2.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva openssl-0.9.7c-3.2.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva openssl-0.9.7c-3.2.C30mdk.src.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
FreeBSD FreeBSD 4.11 -RELEASE-p3
-
FreeBSD htt411.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:09/htt411.patch
FreeBSD FreeBSD 5.3
-
FreeBSD htt5.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:09/htt5.patch
Turbolinux Turbolinux Workstation 7.0
-
Turbolinux openssl-0.9.6m-3.i586.rpm
Turbolinux 7 Workstation
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/ 7/updates/RPMS/openssl-0.9.6m-3.i586.rpm -
Turbolinux openssl-devel-0.9.6m-3.i586.rpm
Turbolinux 7 Workstation
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/ 7/updates/RPMS/openssl-devel-0.9.6m-3.i586.rpm
References
Multiple Vendor Hyper-Threading Technology Information Disclosure Vulnerability
References:
References:
- [Fwd: Re: FW:FreeBSD hiding security stuff] (freebsd-security)
- Cache Missing for Fun and Profit (Colin Percival)
- FreeBSD Homepage (FreeBSD)
- Hyper-Threading Considered Harmful (Colin Percival)
- Re: Fwd: FreeBSD hiding security stuff (freebsd-security)
- RHSA-2005:476-08 : openssl security update (RedHat)
- Sun Alert ID: 101739 (Sun)