A tenant performing cryptographic operations on shared IaaS hosts is concerned that another tenant's virtual machine on the same physical server could infer its private keys by measuring timing differences in shared CPU caches. Which threat is the tenant describing?
Select an answer to reveal the explanation.
Short Explanation
Think of it like hearing a safe's tumblers click through a thin wall: nobody opens the safe, they just listen. A side-channel attack reads secrets from timing and cache behavior on hardware you share with a neighbor. VM escape is a different beast, because there the attacker actually breaks out of the guest.
Full Explanation
Side-channel attacks extract information not from a direct flaw in access control but from observable effects of computation, such as timing, cache usage, power consumption or electromagnetic emissions. In multi-tenant clouds, co-resident virtual machines share physical CPU caches and other microarchitectural resources, so a malicious tenant can measure contention patterns to infer another tenant's cryptographic keys or data, a concern highlighted by speculative execution vulnerabilities. Mitigations include dedicated or single-tenant hosts for sensitive workloads, constant-time cryptographic implementations, provider microcode and hypervisor patches, and hardware security modules that keep key operations off shared processors. A virtual machine escape is an isolation failure in which guest code executes on the host or hypervisor, giving direct control; the scenario describes inference without breaking out. Data remanence concerns leftover data on storage media after deallocation, not live CPU behavior. Hyperjacking means subverting or replacing the hypervisor itself, a far more invasive compromise than measuring cache timing from a guest. Exam caveat: side channels are a shared technology issue, so the tenant's strongest lever is reducing co-residency. Operational check: confirm whether workloads handling long-term private keys run on dedicated hosts or in an HSM rather than on shared general-purpose instances.