Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1422: Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution

Base Incomplete

A processor event or prediction may allow incorrect or stale data to
be forwarded to transient operations, potentially exposing data over a
covert channel.

More detail

Software may use a variety of techniques to preserve the
confidentiality of private data that is accessible within the current
processor context. For example, the memory safety and type safety
properties of some high-level programming languages help to prevent
software written in those languages from exposing private data. As a
second example, software sandboxes may co-locate multiple users'
software within a single process. The processor's Instruction Set
Architecture (ISA) may permit one user's software to access another
user's data (because the software shares the same address space), but
the sandbox prevents these accesses by using software techniques such
as bounds checking.

If incorrect or stale data can be forwarded (for example, from a
cache) to transient operations, then the operations'
microarchitectural side effects may correspond to the data. If an
attacker can trigger these transient operations and observe their side
effects through a covert channel, then the attacker may be able to
infer the data. For example, an attacker process may induce transient
execution in a victim process that causes the victim to inadvertently
access and then expose its private data via a covert channel. In the
software sandbox example, an attacker sandbox may induce transient
execution in its own code, allowing it to transiently access and
expose data in a victim sandbox that shares the same address space.

Consequently, weaknesses that arise from incorrect/stale data
forwarding might violate users' expectations of software-based memory
safety and isolation techniques. If the data forwarding behavior is
not properly documented by the hardware vendor, this might violate the
software vendor's expectation of how the hardware should behave.

How to prevent it (8 mitigations)

  1. Architecture and Design

    The hardware designer can attempt to prevent transient
    execution from causing observable discrepancies in specific covert
    channels.

  2. Requirements

    Processor designers, system software vendors, or other
    agents may choose to restrict the ability of unprivileged software to
    access to high-resolution timers that are commonly used to monitor
    covert channels.

  3. Requirements

    Processor designers may expose instructions or other
    architectural features that allow software to mitigate the effects of
    transient execution, but without disabling predictors. These features
    may also help to limit opportunities for data exposure.

  4. Requirements

    Processor designers may expose registers (for example,
    control registers or model-specific registers) that allow privileged
    and/or user software to disable specific predictors or other hardware
    features that can cause confidential data to be exposed during
    transient execution.

  5. Build and Compilation

    Use software techniques (including the use of
    serialization instructions) that are intended to reduce the number of
    instructions that can be executed transiently after a processor event
    or misprediction.

  6. Build and Compilation

    Isolate sandboxes or managed runtimes in separate address
    spaces (separate processes).

  7. Build and Compilation

    Include serialization instructions (for example, LFENCE)
    that prevent processor events or mis-predictions prior to the
    serialization instruction from causing transient execution after the
    serialization instruction. For some weaknesses, a serialization
    instruction can also prevent a processor event or a mis-prediction
    from occurring after the serialization instruction (for example,
    CVE-2018-3639 can allow a processor to predict that a load will not
    depend on an older store; a serialization instruction between the
    store and the load may allow the store to update memory and prevent
    the mis-prediction from happening at all).

  8. Build and Compilation

    Use software techniques that can mitigate the
    consequences of transient execution. For example, address masking can
    be used in some circumstances to prevent out-of-bounds transient
    reads.

Source: MITRE CWE-1422

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.