OS makers slow to fix flaw, researcher says
Microsoft and some Linux vendors have yet to patch a hole related to a flaw in some Intel chips, despite having two months' notice.
Colin Percival detailed the vulnerability--which affects versions of Intel's CPU that use a technology called hyperthreading--at a conference on May 13.
The vulnerability could allow a local hacker to steal sensitive information, such as passwords, held on servers configured to allow multiple users to log in simultaneously.
FreeBSD security team member Percival has received formal responses to the issue from the makers of the BSD family of open-source operating systems, as well as SCO and Ubuntu Linux. However, Linux vendors Red Hat, Novell and Mandriva have been slow to act, as has Microsoft, he said.
"Given that I reported this problem in early March, I really think that they should have had a patch over a month ago--in time to test it extensively before releasing it on May 13," Percival said.
"I made it quite clear to everyone that I would be releasing my paper on that date and that they should make sure they were ready by then," he added.
A representative from Red Hat said its security team rated the issue as having "a moderate security impact," and that it was working with the creators of the OpenSSL toolkit--which is used to exploit the vulnerability--on a fix.
A Microsoft representative said while the company was investigating Percival's report, it was not aware of any active attacks using this method at this time and would wait until completion of its investigation to take action.
"We are aware of the issue and have been working on it," a Novell representative said.
Percival also took issue with Intel's reaction. The company had described the risk as "very low."
"Intel is being too simplistic," he said. "This flaw allows users on a machine to steal each others' data."
Although the problem only affects multiuser servers, these machines are widely used. "The most obvious example is shared Web servers, which constitutes the vast majority of small e-commerce sites," he said. "On these systems, the flaw is very serious."
Last December, Percival alerted the BSD family to the problem, and a workaround has since been posted.