PortSmash CVE-2018-5407 - @RaptorEng @IBMPowerSystems
Any comments on how vulnerable #POWER9 is to this kind of attack?
Especially with regard to the Nimbus SMT4 core pairs being very similar to single SMT8 Cumulus cores.
@RaptorCompSys, your 8 & 4 core chips are unpaired, right?https://twitter.com/marcan42/status/1058405454999543808 …
-
The latter is correct. If this specific type of attack is a concern, we would recommend placing the system into SMT1 mode to disable threading. A better solution would probably be to place sensitive threads (.e.g. kernel threads) on their own physical resources via cgroups.
What we really need is kernel scheduling support for atomically grouping tasks by security context and integrity level, and better isolation controls on task switching (e.g. more aggressive cache flushes).
