Scholar describes duty to responsibly disclose Hyper-Threading side-channel vulnerability
Original title: The Duty of a Scholar
The author contacted Intel and open source vendors about a cache side-channel in Hyper-Threading before public disclosure, prioritizing the fix over career.
The author identified a side-channel in Intel Hyper-Threading that could leak information between threads. He built a proof-of-concept exploit allowing RSA private key reconstruction. For six months he notified security teams at Intel, FreeBSD, NetBSD, Red Hat, SCO, and Ubuntu to prepare coordinated patches. He draws parallels to engineering professional ethics codes such as those of the IEEE.
- Contacted Intel and open source projects for coordinated disclosure
- Prioritized security fix over personal career
- Referenced professional engineering ethics codes
Impact: information leakage between execution threads via cache state
- Products
- Hyper-Threading
- Organizations
- IEEE
From the original article
8 min read at daemonology.netOn November 16th, 2004 — π years after arriving in Oxford — I My mind wasn't really on my thesis though; I was thinking about an issue I had noticed in recent Intel CPUs: The "Hyper-Threading" (simultaneous
By daemonology.net via krinkle · daemonology.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.