Hi! This is the ezmlm program. I'm managing the
bugtraq@securityfocus.com mailing list.

I'm working for my owner, who can be reached
at bugtraq-owner@securityfocus.com.

Messages to you from the bugtraq mailing list seem to
have been bouncing. I've attached a copy of the first bounce
message I received.

If this message bounces too, I will send you a probe. If the probe bounces,
I will remove your address from the bugtraq mailing list,
without further notice.

I've kept a list of which messages from the bugtraq mailing list have
bounced from your address.

Copies of these messages may be in the archive.

To retrieve a set of messages 123-145 (a maximum of 100 per request),
send an empty message to:
<bugtraq-get.123_145@securityfocus.com>

To receive a subject and author list for the last 100 or so messages,
send an empty message to:
<bugtraq-index@securityfocus.com>

Here are the message numbers:

19673
19677
19676
19679
19674
19675
19678
19680
19681
19682
19683
19685
19688
19684
19686
19687
19691
19689
19690
19692
19693
19694
--- Enclosed is a copy of the bounce message I received.
Return-Path: <>
Received: (qmail 4748 invoked from network); 15 May 2005 08:40:02 -0000
Received: from mail2.securityfocus.com (205.206.231.1)
by lists2.securityfocus.com with SMTP; 15 May 2005 08:40:02 -0000
Received: (qmail 28412 invoked by alias); 15 May 2005 15:53:14 -0000
Received: (qmail 28403 invoked from network); 15 May 2005 15:53:13 -0000
Received: from mgate1.csie.nctu.edu.tw (140.113.17.201)
by mail2.securityfocus.com with SMTP; 15 May 2005 15:53:13 -0000
Received: from mgate1.csie.nctu.edu.tw ([140.113.17.201]) by mgate1.csie.nctu.edu.tw
via smtpd (for mail2.securityfocus.com [205.206.231.1]) with ESMTP; Sun, 15 May 2005 09:11:56 -0700
Received: by mgate1.csie.nctu.edu.tw (Postfix)
id C6A505F68DC; Mon, 16 May 2005 00:11:40 +0800 (CST)
Date: Mon, 16 May 2005 00:11:40 +0800 (CST)
From: MAILER-DAEMON@csie.nctu.edu.tw (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: bugtraq-return-19673-bugtraq=freebsd.csie.nctu.edu.tw@securityfocus.com
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="6B7BC5D49D5.1116173500/mgate1.csie.nctu.edu.tw"
Message-Id: <20050515161140.C6A505F68DC@mgate1.csie.nctu.edu.t w>

This is a MIME-encapsulated message.

--6B7BC5D49D5.1116173500/mgate1.csie.nctu.edu.tw
Content-Description: Notification
Content-Type: text/plain

This is the Postfix program at host mgate1.csie.nctu.edu.tw.

I'm sorry to have to inform you that the message returned
below could not be delivered to one or more destinations.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the message returned below.

The Postfix program

<bugtraq@freebsd.csie.nctu.edu.tw>: connect to
freebsd.csie.nctu.edu.tw[140.113.17.209]: Operation timed out

--6B7BC5D49D5.1116173500/mgate1.csie.nctu.edu.tw
Content-Description: Delivery error report
Content-Type: message/delivery-status

Reporting-MTA: dns; mgate1.csie.nctu.edu.tw
Arrival-Date: Sat, 14 May 2005 00:00:07 +0800 (CST)

Final-Recipient: rfc822; bugtraq@freebsd.csie.nctu.edu.tw
Action: failed
Status: 4.0.0
Diagnostic-Code: X-Postfix; connect to
freebsd.csie.nctu.edu.tw[140.113.17.209]: Operation timed out

--6B7BC5D49D5.1116173500/mgate1.csie.nctu.edu.tw
Content-Description: Undelivered Message
Content-Type: message/rfc822

Received: from localhost (localhost [127.0.0.1])
by localhost (Postfix) with ESMTP id 6B7BC5D49D5
for <bugtraq@freebsd.csie.nctu.edu.tw>; Sat, 14 May 2005 00:00:07 +0800 (CST)
Received: from outgoing.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mgate1.csie.nctu.edu.tw (Postfix) with ESMTP id E1FE25D4A13
for <bugtraq@freebsd.csie.nctu.edu.tw>; Fri, 13 May 2005 23:59:13 +0800 (CST)
Received: from outgoing.securityfocus.com by outgoing.securityfocus.com
via smtpd (for mgate1.csie.nctu.edu.tw [140.113.17.201]) with ESMTP; Fri, 13 May 2005 08:59:13 -0700
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 2EABF236FB0; Fri, 13 May 2005 09:34:13 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 5943 invoked from network); 13 May 2005 07:53:31 -0000
Date: Fri, 13 May 2005 15:25:00 GMT
Message-Id: <200505131525.j4DFP0Kw029299@freefall.freebsd.or g>
X-Authentication-Warning: freefall.freebsd.org: nectar set sender to security-advisories@freebsd.org using -f
From: FreeBSD Security Advisories <security-advisories@freebsd.org>
To: Bugtraq <bugtraq@securityfocus.com>
Subject: FreeBSD Security Advisory FreeBSD-SA-05:09.htt [REVISED]
Reply-To: security-advisories@freebsd.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===========================
FreeBSD-SA-05:09.htt Security Advisory
The FreeBSD Project

Topic: information disclosure when using HTT

Category: core
Module: sys
Announced: 2005-05-13
Revised: 2005-05-13
Credits: Colin Percival
Affects: All FreeBSD/i386 and FreeBSD/amd64 releases.
Corrected: 2005-05-13 00:13:00 UTC (RELENG_5, 5.4-STABLE)
2005-05-13 00:13:00 UTC (RELENG_5_4, 5.4-RELEASE-p1)
2005-05-13 00:13:00 UTC (RELENG_5_3, 5.3-RELEASE-p15)
2005-05-13 00:13:00 UTC (RELENG_4, 4.11-STABLE)
2005-05-13 00:13:00 UTC (RELENG_4_11, 4.11-RELEASE-p9)
2005-05-13 00:13:00 UTC (RELENG_4_10, 4.10-RELEASE-p14)
CVE Name: CAN-2005-0109

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.

0. Revision History

v1.0 2005-05-13 Initial release.
v1.1 2005-05-13 Additional details.

I. Background

Sharing the execution resources of a superscalar processor between
multiple execution threads is referred to as "simultaneous
multithreading". "Hyper-Threading Technology" or HTT is the name used
for the implementation of simultaneous multithreading on Intel Pentium
4, Mobile Pentium 4, and Xeon processors. HTT involves sharing
certain CPU resources between multiple threads, including memory
caches. FreeBSD supports HTT when using a kernel compiled with
the SMP option.

II. Problem Description

When running on processors supporting Hyper-Threading Technology, it is
possible for a malicious thread to monitor the execution of another
thread.

NOTE: Similar problems may exist in other simultaneous multithreading
implementations, or even some systems in the absence of simultaneous
multithreading. However, current research has only demonstrated this
flaw in Hyper-Threading Technology, where shared memory caches are used.

III. Impact

Information may be disclosed to local users, allowing in many cases for
privilege escalation. For example, on a multi-user system, it may be
possible to steal cryptographic keys used in applications such as OpenSSH
or SSL-enabled web servers.

IV. Workaround

Systems not using processors with Hyper-Threading Technology support are
not affected by this issue. On systems which are affected, the security
flaw can be eliminated by setting the "machdep.hlt_logical_cpus" tunable:

# echo "machdep.hlt_logical_cpus=1" >> /boot/loader.conf

The system must be rebooted in order for tunables to take effect.

Use of this workaround is not recommended on "dual-core" systems, as
this workaround will also disable one of the processor cores.

V. Solution

Disable Hyper-Threading Technology on processors that support it.

NOTE: It is expected that future work in cryptographic libraries and
operating system schedulers may remedy this problem for many or most
users, without necessitating the disabling of Hyper-Threading
Technology. Future advisories will address individual cases.

Perform one of the following:

1) Upgrade your vulnerable system to 4-STABLE or 5-STABLE, or to the
RELENG_5_4, RELENG_5_3, RELENG_4_11, or RELENG_4_10 security branch
dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 4.10,
4.11, 5.3, and 5.4 systems.

a) Download the relevant patch from the location below and verify the
detached PGP signature using your PGP utility.

[FreeBSD 4.10]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CE...9/htt410.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CE...t410.patch.asc

[FreeBSD 4.11]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CE...9/htt411.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CE...t411.patch.asc

[FreeBSD 5.x]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CE...:09/htt5.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CE...htt5.patch.asc

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
system.

NOTE: For users that are certain that their environment is not affected
by this vulnerability, such as single-user systems, Hyper-Threading
Technology may be re-enabled by setting the tunable
"machdep.hyperthreading_allowed".

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_4
src/sys/i386/i386/mp_machdep.c 1.115.2.23
src/sys/i386/include/cpufunc.h 1.96.2.4
RELENG_4_11
src/UPDATING 1.73.2.91.2.10
src/sys/conf/newvers.sh 1.44.2.39.2.13
src/sys/i386/i386/mp_machdep.c 1.115.2.22.2.1
src/sys/i386/include/cpufunc.h 1.96.2.3.12.1
RELENG_4_10
src/UPDATING 1.73.2.90.2.15
src/sys/conf/newvers.sh 1.44.2.34.2.16
src/sys/i386/i386/mp_machdep.c 1.115.2.20.2.1
src/sys/i386/include/cpufunc.h 1.96.2.3.10.1
RELENG_5
src/sys/amd64/amd64/mp_machdep.c 1.242.2.11
src/sys/amd64/include/cpufunc.h 1.145.2.1
src/sys/i386/i386/mp_machdep.c 1.235.2.10
src/sys/i386/include/cpufunc.h 1.142.2.1
RELENG_5_4
src/UPDATING 1.342.2.24.2.10
src/sys/amd64/amd64/mp_machdep.c 1.242.2.7.2.4
src/sys/amd64/include/cpufunc.h 1.145.6.1
src/sys/conf/newvers.sh 1.62.2.18.2.6
src/sys/i386/i386/mp_machdep.c 1.235.2.6.2.3
src/sys/i386/include/cpufunc.h 1.142.6.1
RELENG_5_3
src/UPDATING 1.342.2.13.2.18
src/sys/amd64/amd64/mp_machdep.c 1.242.2.2.2.2
src/sys/amd64/include/cpufunc.h 1.145.4.1
src/sys/conf/newvers.sh 1.62.2.15.2.20
src/sys/i386/i386/mp_machdep.c 1.235.2.3.2.2
src/sys/i386/include/cpufunc.h 1.142.4.1
- -------------------------------------------------------------------------

VII. References

http://www.daemonology.net/hyperthre...dered-harmful/

The latest revision of this advisory is available at
ftp://ftp.freebsd.org/pub/FreeBSD/CE...-05:09.htt.asc
-----BEGIN PGP SIGNATURE-----

iD8DBQFChJA4FdaIBMps37IRAo8nAJ9w7xtIF0atnxiKDhFOpB XEZQDtZQCghWdM
qc5lGST7l+iJEYN/7zTNUPY=
=WqEa
-----END PGP SIGNATURE-----

--6B7BC5D49D5.1116173500/mgate1.csie.nctu.edu.tw--