Vulnerability
Frequency Throttling Side Channel
Data-dependent power changes the frequency a processor throttles to near its power limits, turning power side channels into timing, even remotely.
- Also known as
- Hertzbleed
- Kind
- Side channel
- CVEs
- 2
- Published
- 2022
Processors lower their frequency when power or current reaches a
limit. Power depends on the data being processed, so under load the
frequency, and with it the time an operation takes, depends on the
data: code that runs in constant cycles no longer runs in constant
time. An attacker needs the victim to repeat work with the same key,
a way to push the system to its limits, and fine enough timing.
CVEs
| CVE | Name | Vendors | Published |
|---|---|---|---|
| CVE-2022-23823 | Frequency Scaling Timing Power Side-Channels (Hertzbleed) | AMD | 2022-06-15 |
| CVE-2022-24436 | Frequency Throttling Side Channel (described below) | Intel | 2022-06-15 |
CVEs without a page of their own
The sources give these CVEs too few facts of their own (affected processors, a mitigation, a check) for a page; this is what they say.
CVE-2022-24436: Frequency Throttling Side Channel
Intel: all Intel processors are affected; no microcode addresses it, and Intel's guidance is for cryptographic code: masking, key refresh, limiting input per call. INTEL-SA-00698. Source. CVE record (2022-06-15).