[hhdhdbdb]

Any timing attacks possible on a virtualized system using dedupe?

Eg find out what my neighbours have installed.

Or if the data before an SSH key is predictable, keep writing that out to disk guessing the next byte or something like that.

[aidenn0]

I don't think you even need timing attacks if you can read the zpool statistics; you can ask for a histogram of deduped blocks.

Guessing one byte at a time is not possible though because dedupe is block-level in ZFS.

[beng-nl]

Gosh, you’re likely right, but what if comparing the blocks (to decide on deduping) is a byte at a time and somehow that can be detected (with a timing channel or a uarch side channel)? Zfs likely compares the hash, but I think KSM doesn’t use hashes but memcmp (or something in that spirit) to avoid collisions. So just maybe… just maybe GP is onto something.. interesting fantasy ;-)

[hhdhdbdb]

Thanks for putting meat on the (speculitive) bone I threw out! Very interesting.

[UltraSane]

VMWare ESXi used to dedupe RAM and had to disable this by default because of a security issue it caused that leaded data between VMs.