Colin Percival, a FreeBSD committer and security team member, has found a local exploit against the current implementation of Intel's Hyper-Threading Technology. "Hyper-Threading, as currently implemented on Intel Pentium Extreme Edition, Pentium 4, Mobile Pentium 4, and Xeon processors, suffers from a serious security flaw," Colin explains. "This flaw permits local information disclosure, including allowing an unprivileged user to steal an RSA private key being used on the same machine. Administrators of multi-user systems are strongly advised to take action to disable Hyper-Threading immediately."

Colin will present the details behind the attack at BSDCan 2005 at 10:00 AM EDT on May 13'th. "At the conclusion of my talk I will also be releasing a paper describing the attack and possible mitigation strategies," Colin explains. The flaw affects all operating systems, and for a secure multi-user environment essentially requires that Hyper-Threading be disabled. More information can be found on Colin's web page on the topic. The formentioned paper can be downloaded here in pdf format.