By 
A new security vulnerability known as Hertzbleed was discovered in modern Intel and AMD processors that could let remote attackers steal encryption keys via a power side channel attack.
The side-channel attack was disclosed by a group of researchers from the University of Texas, the University of Illinois Urbana-Champaign, and the University of Washington.
The issue is rooted in dynamic voltage and frequency scaling (DVFS), a power and thermal management feature employed to conserve power and reduce the amount of heat generated by a chip.
The researchers stated that under certain circumstances, periodic CPU frequency adjustments depend on the current CPU power consumption, and these adjustments directly translate to execution time differences (as 1 hertz = 1 cycle per second).
This can have significant security implications on cryptographic libraries even when implemented correctly as constant-time code to prevent timing-based side channels, allowing an attacker to leverage the execution time variations to extract sensitive information such as cryptographic keys.
In response to the findings both AMD (CVE-2022-23823) and Intel (CVE-2022-24436) have issued independent advisories. Intel noted that all their processors are affected by Hertzbleed and no patches have been made available.
AMD also revealed that Hertzbleed affects several of its products, including desktop, mobile, Chromebook, and server CPUs using the Zen 2 and Zen 3 microarchitectures.
AMD stated that as the vulnerability impacts a cryptographic algorithm having power analysis-based side channel leakages, developers can apply countermeasures on the software code of the algorithm. In order to mitigate the attack, either masking, hiding, or key-rotation may be used.
Intel recommended that cryptographic developers follow its guidance to harden their libraries and applications against frequency throttling information disclosure.
Image Credits : Hot Hardware
