NetCAT CPU Vulnerability

Security researchers have disclosed details of a hardware vulnerability and corresponding side-channel attack in all Intel server-grade central processing units (CPUs) since 2012, named Network Cache ATtack or NetCAT.

Threat ID:: CC-3217
Category:
Threat Severity:: Low
Threat Vector:
Published:: 17 September 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Affected platforms

The following platforms are known to be affected:

Xeon Processor Scalable Family

Intel Xeon E5, E7 and SP families that support DDIO and RDMA

Threat details

They claim that NetCAT could allow an attacker with direct network connection to a target machine access to sensitive information, and that it is exploitable on all modern operating systems.

Modern Intel server-grade CPUs have an optimisation feature called Data Direct I/O (DDIO) that allows peripheral devices, such as network cards, direct access to data inside the CPU cache. DDIO allows data to be processed at higher speeds than if it was stored in RAM, and is enabled by default for all Intel server-grade CPUs.

Remote Direct Memory Access (RDMA) allows devices on a network to exchange data in memory without interacting with the CPU, cache or operating system of either computer. This improves networking speeds and throughput, and reduces latencies.

NetCAT is a network-based side-channel attack that allows an attacker to steal keystrokes and sensitive information from data that arrives as network packets from a Secure Shell (SSH) session and lands directly in the DDIO shared cache. This means that an attacker with a direct network connection to an affected system can leak sensitive information about other clients connected to the same system. Successful NetCAT attacks require only DDIO to be enabled, although attacks where RDMA is also enabled are more efficient.

For further information and technical analysis:

Remediation steps

Type	Step
	As NetCAT is a hardware vulnerability, it is unclear at the time of publication if the effects of it can be fully mitigated in the affected platforms. Intel have recommended affected organisations follow the guidance outlined in their Security Best Practices For Side Channel Resistance and Guidelines For Mitigating Timing Side Channels Against Cryptographic Implementation papers. They have also suggested the following actions may be taken to partially mitigate NetCAT: Limiting DDIO and RDMA access to devices on untrusted networks. Ensuring software employs constant-time coding practices to reduce the risk of timing attacks such as NetCAT.

Type

Step

As NetCAT is a hardware vulnerability, it is unclear at the time of publication if the effects of it can be fully mitigated in the affected platforms. Intel have recommended affected organisations follow the guidance outlined in their Security Best Practices For Side Channel Resistance and Guidelines For Mitigating Timing Side Channels Against Cryptographic Implementation papers. They have also suggested the following actions may be taken to partially mitigate NetCAT:

Limiting DDIO and RDMA access to devices on untrusted networks.
Ensuring software employs constant-time coding practices to reduce the risk of timing attacks such as NetCAT.

CVE Vulnerabilities

Status

CVE-2019-11184

Last edited: 14 February 2020 2:54 pm