Overview
This series explains how Open vSwitch (OVS) caches shared by traffic from multiple VMs can turn forwarding state into a remotely measurable timing side channel under tested conditions. It traces microflow collisions and megaflow ordering, distinguishes covert communication, selected header recovery, and approximate packet-rate inference, then matches mitigations to each path. The evidence supports a serious but topology- and datapath-dependent risk judgment, not universal exploitability.
Learning outcomes
- Shared OVS forwarding state can create a cross-VM timing side channel when traffic and probes reach the same instance.
- Microflow collisions can support selected source-IP and source-port recovery when destination fields, hash behavior, and sustained probing are known.
- Megaflow subtable ordering can reveal an approximate packet-rate range, especially for stable flows, not packet contents.
- Instance isolation, microflow randomization, and megaflow reorder randomization address different state transitions; network controls alone do not replace them.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
How can Open vSwitch create a cross-VM side channel?
Open vSwitch can create one when multiple workloads share forwarding caches and a reachable service exposes cache-dependent latency. Repeated probes let an observer infer state changes without direct access to another VM's packets.
What can an Open vSwitch timing side channel reveal?
It can reveal cache-state changes and, under the study's conditions, support covert communication, selected source-header recovery, or approximate packet-rate inference. These outputs require different knowledge and access assumptions.
Does the study show that Open vSwitch exposes packet contents?
No. It does not demonstrate arbitrary payload disclosure; its attacks recover selected header fields or approximate traffic rates under specific knowledge, datapath, topology, and workload conditions.
Which defenses reduce Open vSwitch side-channel risk?
Separate OVS instances remove the demonstrated shared-cache mediator; microflow randomization disrupts collision reasoning; megaflow reorder randomization weakens rate inference. Segmentation, firewalls, monitoring, and redundancy remain complementary controls.