Bug 1828580 (CVE-2020-8694) - CVE-2020-8694 kernel: Insufficient access control vulnerability in PowerCap Framework
Summary: CVE-2020-8694 kernel: Insufficient access control vulnerability in PowerCap F...
Keywords:
Status: NEW
Alias: CVE-2020-8694
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 1844297 1844298 1844299 1844300 1896525 1957867 1957868
Blocks: 1828581
TreeView+ depends on / blocked
 
Reported: 2020-04-27 20:34 UTC by Pedro Sampaio
Modified: 2024-01-19 19:11 UTC (History)
42 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel's implementation of Intel's Running Average Power Limit (RAPL) implementation. A local attacker could infer secrets by measuring power usage and also infer private data by observing the power usage of calculations performed on the data.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2020-04-27 20:34:41 UTC 
A 'power analysis' side channel was found in the PowerCap framework.  A local authenticated attacker can potentially use the powercap measurements to infer usually private information by measuring the power used by operations on the hidden information.
Comment 12 RaTasha Tillery-Smith 2020-06-04 14:16:22 UTC 
Mitigation:


A temporary measure would be to remove the ability for non-root users 
to read the current RAPL energy reporting metrics.

This can be done with the command:

$ sudo chmod 400 /sys/class/powercap/intel_rapl/*/energy_uj

This mitigation will only work on the current boot and will need to be reapplied at each system boot to remain in effect.
Comment 16 Petr Matousek 2020-06-05 12:15:53 UTC 
Acknowledgments:

Name: Intel
Comment 20 Petr Matousek 2020-11-10 19:33:56 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1896525]
Comment 23 Petr Matousek 2021-05-12 15:36:49 UTC 
Upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=949dd0104c49
Note You need to log in before you can comment on or make changes to this bug.