In a new paper the Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86 is described. Hertzbleed is a new family of side-channel attacks: frequency side channels. At the heart of the issue stands dynamic voltage and frequency scaling (DVFS) in certain x86 CPUs. Based on this setting a bit’s position in a word can be distinguished through frequency changes. The research team showcased the extraction of a constant-time algorithm over the wire. The latter was based on a chosen-ciphertext attack (CCA) attack. Also, in an unoptimized szenario it can take 36 and 89 hours to fully recover a key, depending on the utilized library. Intel tracks it as CVE-2022-24436, AMD as CVE-2022-23823. Mitigations by Intel and AMD are not planned.
