Eric Biggers, one of the developers of the Adiantum cipher and a maintainer of the Linux fscrypt kernel subsystem, proposed a set of patches to address security issues arising from the characteristic of Intel processors that do not guarantee consistent instruction execution times for different processed data. This problem in Intel processors manifests starting from the Ice Lake family. A similar issue is observed in ARM processors.
The presence of a dependency of instruction execution time on the data processed in those instructions is regarded by the patch author as a vulnerability in processors, as such behavior cannot guarantee the security of cryptographic operations performed in the system. Many implementations of cryptographic algorithms are based on the assumption that data does not affect instruction execution time, and violating this behavior can lead to the creation of side-channel attacks that recover data based on timing analysis.
Potentially, the dependency of execution time on data can also be used to organize attacks that determine kernel data from user space. According to Eric Biggers, constant execution time is not ensured even for instructions performing addition and XOR operations, as well as for specialized AES-NI instructions (this information is not confirmed by tests; other data indicates that a delay of one cycle occurs during vector multiplication and bit counting).
To disable the discussed behavior, Intel and ARM have proposed new flags: the PSTATE bit DIT (Data Independent Timing) for ARM CPUs and the MSR bit DOITM (Data Operand Independent Timing Mode) for Intel CPUs, which revert to the old behavior with constant execution time. Intel and ARM recommend enabling this protection as needed for particularly sensitive code; however, important calculations can actually occur in any part of the kernel and user space, so the possibility of permanently activating the DOITM and DIT modes for the entire kernel is being considered.
Patches that change behavior for the Linux kernel 6.2 have already been accepted for ARM processors, but these patches are considered insufficient as they only cover kernel code and do not change behavior for user space. For Intel processors, enabling protection is still in the review stage. The impact of the patch on performance has not yet been measured, but according to Intel's documentation, enabling DOITM mode reduces performance (for example, due to the disabling of certain optimizations like data-specific preloading), and in future processor models, the performance reduction could intensify.
Source: opennet.ru
