Vulnerability
RAPL Energy Reporting
The energy counters of RAPL depend on the data a processor handles, so reading them can reveal secrets, such as keys inside an SGX enclave.
- Also known as
- Running Average Power Limit Energy Reporting, Platypus
- Kind
- Side channel
- CVEs
- 4
- Published
- 2020–2024
RAPL reports the energy a package or core has used. Energy depends
on the data being processed, so an attacker who can read the
counters often enough can infer secrets. The counters update about
every millisecond, which makes that slow. Unprivileged access
through the operating system’s power capping files is one CVE; a
privileged attacker reading them against an SGX enclave is another.
CVEs
| CVE | Name | Vendors | Published |
|---|---|---|---|
| CVE-2020-8694 | RAPL access from user space (Platypus) (described below) | Intel | 2020-11-12 |
| CVE-2020-8695 | RAPL energy reporting (Platypus) | Intel | 2020-11-12 |
| CVE-2020-12912 | AMD energy reporting in Linux (described below) | AMD | 2020-11-12 |
| CVE-2024-23984 | RAPL energy reporting (2024) | Intel | 2024-09-16 |
CVEs without a page of their own
The sources give these CVEs too few facts of their own (affected processors, a mitigation, a check) for a page; this is what they say.
CVE-2020-8694: RAPL access from user space
Linux let unprivileged users read RAPL energy counters through the power capping files; Linux 5.10 limits energy_uj to root. INTEL-SA-00389. Source. Source. CVE record (2020-11-12).
CVE-2020-12912: AMD energy reporting in Linux
AMD's CVE for its Linux hwmon energy driver, which let unprivileged users read energy counters; the CVE record names the driver, not processors. Source. CVE record (2020-11-12).