CWE-1423 詳細

Shared microarchitectural predictor state may allow code to influence transient execution across a hardware boundary, potentially exposing data that is accessible beyond the boundary over a covert channel.

導入モード

Architecture and Design
Implementation
System Configuration

適用可能なプラットフォーム

言語

クラス： Not Language-Specific (Undetermined)

オペレーティングシステム

クラス： Not OS-Specific (Undetermined)

アーキテクチャ

クラス： Not Architecture-Specific (Undetermined)

テクノロジー

名前： Microcontroller Hardware (Undetermined)
名前： Processor Hardware (Undetermined)
名前： Memory Hardware (Undetermined)
クラス： System on Chip (Undetermined)

一般的な結果

観察された例

潜在的な緩和策

Phases : Architecture and Design
Phases : Architecture and Design
Phases : Architecture and Design
Phases : Implementation
Phases : Build and Compilation
Phases : Build and Compilation
Phases : Build and Compilation
Phases : System Configuration
Phases : Patching and Maintenance
Phases : Documentation
Phases : Requirements

検出方法

Manual Analysis

有効性 : Moderate

Automated Analysis

有効性 : High

Automated Analysis

有効性 : Moderate

脆弱性マッピングノート

理由 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities
コメント : Use only when the weakness allows code in one processor context to influence the predictions of code in another processor context via predictor state that is shared between the two contexts. For example, Branch Target Injection, an instance of CWE-1423, can be mitigated by tagging each indirect branch predictor entry according to the processor context in which the entry was created, thus preventing entries created in one context from being used in a different context. However, the mitigated indirect branch predictor can still expose different weaknesses where malicious predictor entries created in one context are used later in the same context (context tags cannot prevent this). One such example is Intra-mode Branch Target Injection. Weaknesses of this sort can map to CWE-1420.

参考文献

REF-1414

Retpoline: A Branch Target Injection Mitigation
Intel Corporation.
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/retpoline-branch-target-injection-mitigation.html

REF-1415

Spectre Attacks: Exploiting Speculative Execution
Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, Yuval Yarom.
https://spectreattack.com/spectre.pdf

REF-1416

Flush+Reload: A High Resolution, Low Noise, L3 Cache Side-Channel Attack
Yuval Yarom, Katrina Falkner.
https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-yarom.pdf

REF-1398

Control Flow Integrity
The Clang Team.
https://clang.llvm.org/docs/ControlFlowIntegrity.html

REF-1389

You Cannot Always Win the Race: Analyzing the LFENCE/JMP Mitigation for Branch Target Injection
Alyssa Milburn, Ke Sun, Henrique Kawakami.
https://arxiv.org/abs/2203.04277

REF-1400

Refined Speculative Execution Terminology
Intel Corporation.
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/refined-speculative-execution-terminology.html

REF-1401

Hardware Security Leak Detection by Symbolic Simulation
Neta Bar Kama, Roope Kaivola.
https://ieeexplore.ieee.org/document/9617727

登録情報

変更履歴