Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution

Base Incomplete

A processor event may allow transient operations to access
architecturally restricted data (for example, in another address
space) in a shared microarchitectural structure (for example, a CPU
cache), potentially exposing the data over a covert channel.

More detail

Many commodity processors have Instruction Set Architecture (ISA)
features that protect software components from one another. These
features can include memory segmentation, virtual memory, privilege
rings, trusted execution environments, and virtual machines, among
others. For example, virtual memory provides each process with its own
address space, which prevents processes from accessing each other's
private data. Many of these features can be used to form
hardware-enforced security boundaries between software components.

Many commodity processors also share microarchitectural resources that
cache (temporarily store) data, which may be confidential. These
resources may be shared across processor contexts, including across
SMT threads, privilege rings, or others.

When transient operations allow access to ISA-protected data in a
shared microarchitectural resource, this might violate users'
expectations of the ISA feature that is bypassed. For example, if
transient operations can access a victim's private data in a shared
microarchitectural resource, then the operations' microarchitectural
side effects may correspond to the accessed data. If an attacker can
trigger these transient operations and observe their side effects
through a covert channel [REF-1400], then the attacker may be able to infer the
victim's private data. Private data could include sensitive program
data, OS/VMM data, page table data (such as memory addresses), system
configuration data (see Demonstrative Example 3), or any other data
that the attacker does not have the required privileges to access.

How to prevent it (8 mitigations)

  1. Architecture and Design

    Hardware designers may choose to engineer the processor's
    pipeline to prevent architecturally restricted data from being used by
    operations that can execute transiently.

  2. Architecture and Design

    Hardware designers may choose not to share
    microarchitectural resources that can contain sensitive data, such as
    fill buffers and store buffers.

  3. Architecture and Design

    Hardware designers may choose to sanitize specific
    microarchitectural state (for example, store buffers) when the
    processor transitions to a different context, such as whenever a
    system call is invoked. Alternatively, the hardware may expose
    instruction(s) that allow software to sanitize microarchitectural
    state according to the user or system administrator's threat
    model. These mitigation approaches are similar to those that address
    CWE-226; however, sanitizing microarchitectural state may not be the
    optimal or best way to mitigate this weakness on every processor
    design.

  4. Architecture and Design

    The hardware designer can attempt to prevent transient
    execution from causing observable discrepancies in specific covert
    channels.

  5. Architecture and Design

    Software architects may design software to enforce strong
    isolation between different contexts. For example, kernel page table
    isolation (KPTI) mitigates the Meltdown vulnerability [REF-1401] by
    separating user-mode page tables from kernel-mode page tables, which
    prevents user-mode processes from using Meltdown to transiently access
    kernel memory [REF-1404].

  6. Build and Compilation

    If the weakness is exposed by a single instruction (or a
    small set of instructions), then the compiler (or JIT, etc.) can be
    configured to prevent the affected instruction(s) from being
    generated, and instead generate an alternate sequence of instructions
    that is not affected by the weakness.

  7. Build and Compilation

    Use software techniques (including the use of
    serialization instructions) that are intended to reduce the number of
    instructions that can be executed transiently after a processor event
    or misprediction.

  8. Implementation

    System software can mitigate this weakness by invoking
    state-sanitizing operations when switching from one context to
    another, according to the hardware vendor's recommendations.

Source: MITRE CWE-1421

All Critical High Medium Low Exploited only Public exploit

4 results · Feed