Bug 2066213 - LZ77: Practical Timing Side Channel Attacks on Memory Compression
Summary: LZ77: Practical Timing Side Channel Attacks on Memory Compression
Keywords:
Status: NEW
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2066219 2066220 2066217 2066218
Blocks: 2065654
TreeView+ depends on / blocked
 
Reported: 2022-03-21 09:22 UTC by Riccardo Schirone
Modified: 2023-07-07 08:32 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Riccardo Schirone 2022-03-21 09:22:37 UTC
LZ77-based compression algorithms are susceptible to timing side channels attacks which could be used by a remote attacker to disclose secret compressed information based on the time it takes for the algorithm to decompress such data. Algorithms such as DEFLATE (in zlib), PGLZ (in PostgreSQL), and zstd if used to store attacker-controlled data together with some secret data (e.g. a cookie) could leak the secret part of the data through the differences in timing required to decompress the data.

References:
https://arxiv.org/abs/2111.08404

Comment 4 Riccardo Schirone 2022-03-21 09:39:42 UTC
It is not clear if there is even a fix for this issue yet. The paper proposes few mitigations:
1) disabling LZ77: I think this would defeat the purpose of compression, so I'm not sure it is feasible
2) masking: protect secrets from being compressed with attacker-controlled data
3) randomization: unclear if it is valuable mitigation
4) keyword protection: uses a "sensitive keyword list" used to split the set of keywords into a subset of secret/sensitive keywords and non-secret ones

According to the paper, probably the best strategy in practice is to avoid sensitive data being compressed with potential attacker-controlled data.


Note You need to log in before you can comment on or make changes to this bug.