名前: Information Exposure through Microarchitectural State after Transient Execution

The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution.

一般情報

導入モード

Architecture and Design
Requirements

適用可能なプラットフォーム

言語

クラス： Not Language-Specific (Undetermined)

オペレーティングシステム

クラス： Not OS-Specific (Undetermined)

アーキテクチャ

クラス： Workstation (Undetermined)
名前： x86 (Undetermined)
名前： ARM (Undetermined)
名前： Other (Undetermined)

テクノロジー

クラス： Not Technology-Specific (Undetermined)
クラス： System on Chip (Undetermined)

一般的な結果

スコープ	影響	可能性
Confidentiality Integrity	Modify Memory, Read Memory, Execute Unauthorized Code or Commands	Medium

観察された例

参考文献	説明
CVE-2020-0551	Load value injection in some processors utilizing speculative execution may allow an authenticated user to enable information disclosure via a side-channel with local access.

潜在的な緩和策

Phases : Architecture and Design // Requirements
Hardware ensures that no illegal data flows from faulting micro-ops exists at the microarchitectural level.
Phases : Build and Compilation
Include instructions that explicitly remove traces of unneeded computations from software interactions with microarchitectural elements e.g. lfence, sfence, mfence, clflush.

脆弱性マッピングノート

理由 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

ノート

CWE-1342 differs from CWE-1303, which is related to misprediction and biasing microarchitectural components, while CWE-1342 addresses illegal data flows and retention. For example, Spectre is an instance of CWE-1303 biasing branch prediction to steer the transient execution indirectly.
As of CWE 4.9, members of the CWE Hardware SIG are closely analyzing this entry and others to improve CWE's coverage of transient execution weaknesses, which include issues related to Spectre, Meltdown, and other attacks. Additional investigation may include other weaknesses related to microarchitectural state. As a result, this entry might change significantly in CWE 4.10.

参考文献

REF-1202

LVI - Hijacking Transient Execution with Load Value Injection
Jo Van Bulck, Daniel Moghimi, Michael Schwarz, Moritz Lipp, Marina Minkin, Daniel Genkin, Yuval Yarom, Berk Sunar, Daniel Gruss, and Frank Piessens.
https://lviattack.eu/

REF-1203

LVI: Hijacking Transient Execution through Microarchitectural Load Value Injection
Jo Van Bulck, Daniel Moghimi, Michael Schwarz, Moritz Lipp, Marina Minkin, Daniel Genkin, Yuval Yarom, Berk Sunar, Daniel Gruss, and Frank Piessens.
https://lviattack.eu/lvi.pdf

REF-1204

Hijacking Transient Execution through Microarchitectural Load Value Injection
https://www.youtube.com/watch?v=99kVz-YGi6Y

REF-1205

CacheOut: Leaking Data on Intel CPUs via Cache Evictions
Stephan van Schaik, Marina Minkin, Andrew Kwong, Daniel Genkin, Yuval Yarom.
https://cacheoutattack.com/files/CacheOut.pdf

登録情報

名前	組織	日付	リリース日	Version
Array	Cycuity (originally submitted as Tortuga Logic)	2021-09-22 +00:00	2021-10-28 +00:00	4.6

変更履歴

名前	組織	日付	コメント
CWE Content Team	MITRE	2022-10-13 +00:00	updated Demonstrative_Examples, Maintenance_Notes, Related_Attack_Patterns
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2024-02-29 +00:00	updated Description
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Relationships

CWE-1342 詳細

CWE-1342