BaseIncompleteCWE-1420

CWE-1420: Exposure of Sensitive Information during Transient Execution

Description

A processor event or prediction may allow incorrect operations (or correct operations with incorrect data) to execute transiently, potentially exposing data over a covert channel.

Abstraction: BaseA weakness specific enough to point to detection and prevention methods.
Likelihood of exploit: Not rated by MITRE
Status: Incomplete

Common consequences

Confidentiality
Read Memory

Potential mitigations

Architecture and DesignEffectiveness: Limited
The hardware designer can attempt to prevent transient execution from causing observable discrepancies in specific covert channels.
RequirementsEffectiveness: Moderate
Processor designers may expose instructions or other architectural features that allow software to mitigate the effects of transient execution, but without disabling predictors. These features may also help to limit opportunities for data exposure.
RequirementsEffectiveness: Limited
Processor designers may expose registers (for example, control registers or model-specific registers) that allow privileged and/or user software to disable specific predictors or other hardware features that can cause confidential data to be exposed during transient execution.
RequirementsEffectiveness: Defense in Depth
Processor designers, system software vendors, or other agents may choose to restrict the ability of unprivileged software to access to high-resolution timers that are commonly used to monitor covert channels.
Build and CompilationEffectiveness: High
Isolate sandboxes or managed runtimes in separate address spaces (separate processes). For examples, see.
Build and CompilationEffectiveness: Moderate
Include serialization instructions (for example, LFENCE) that prevent processor events or mis-predictions prior to the serialization instruction from causing transient execution after the serialization instruction. For some weaknesses, a serialization instruction can also prevent a processor event or a mis-prediction from occurring after the serialization instruction (for example, CVE-2018-3639 can allow a processor to predict that a load will not depend on an older store; a serialization instruction between the store and the load may allow the store to update memory and prevent the prediction...
Build and CompilationEffectiveness: Moderate
Use control-flow integrity (CFI) techniques to constrain the behavior of instructions that redirect the instruction pointer, such as indirect branch instructions.
Build and CompilationEffectiveness: Limited
If the weakness is exposed by a single instruction (or a small set of instructions), then the compiler (or JIT, etc.) can be configured to prevent the affected instruction(s) from being generated, and instead generate an alternate sequence of instructions that is not affected by the weakness. One prominent example of this mitigation is retpoline ().

MITRE lists 3 more mitigations on the official entry.

Related weaknesses

Parent weaknesses

CWE-669Incorrect Resource Transfer Between Spheres

Child weaknesses

CAPEC attack patterns that exploit it

CWE 4.20 links no CAPEC attack pattern to this weakness.

Potential mitigations

Architecture and DesignEffectiveness: Limited

The hardware designer can attempt to prevent transient execution from causing observable discrepancies in specific covert channels.

RequirementsEffectiveness: Moderate

Processor designers may expose instructions or other architectural features that allow software to mitigate the effects of transient execution, but without disabling predictors. These features may also help to limit opportunities for data exposure.

RequirementsEffectiveness: Limited

Processor designers may expose registers (for example, control registers or model-specific registers) that allow privileged and/or user software to disable specific predictors or other hardware features that can cause confidential data to be exposed during transient execution.

RequirementsEffectiveness: Defense in Depth

Processor designers, system software vendors, or other agents may choose to restrict the ability of unprivileged software to access to high-resolution timers that are commonly used to monitor covert channels.

Build and CompilationEffectiveness: High

Isolate sandboxes or managed runtimes in separate address spaces (separate processes). For examples, see.

Build and CompilationEffectiveness: Moderate

Include serialization instructions (for example, LFENCE) that prevent processor events or mis-predictions prior to the serialization instruction from causing transient execution after the serialization instruction. For some weaknesses, a serialization instruction can also prevent a processor event or a mis-prediction from occurring after the serialization instruction (for example, CVE-2018-3639 can allow a processor to predict that a load will not depend on an older store; a serialization instruction between the store and the load may allow the store to update memory and prevent the prediction...

Build and CompilationEffectiveness: Moderate

Use control-flow integrity (CFI) techniques to constrain the behavior of instructions that redirect the instruction pointer, such as indirect branch instructions.

Build and CompilationEffectiveness: Limited

If the weakness is exposed by a single instruction (or a small set of instructions), then the compiler (or JIT, etc.) can be configured to prevent the affected instruction(s) from being generated, and instead generate an alternate sequence of instructions that is not affected by the weakness. One prominent example of this mitigation is retpoline ().

MITRE lists 3 more mitigations on the official entry.