CWE-1421 상세 정보

A processor event may allow transient operations to access architecturally restricted data (for example, in another address space) in a shared microarchitectural structure (for example, a CPU cache), potentially exposing the data over a covert channel.

취약점 도입 방식

Architecture and Design
Implementation
System Configuration
Architecture and Design

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

운영 체제

클래스: Not OS-Specific (Undetermined)

아키텍처

클래스: Not Architecture-Specific (Undetermined)

기술

클래스: Not Technology-Specific (Undetermined)

일반적인 결과

관찰된 예시

잠재적 완화 방법

Phases : Architecture and Design
Phases : Architecture and Design
Phases : Architecture and Design
Phases : Architecture and Design
Phases : Architecture and Design
Phases : Build and Compilation
Phases : Build and Compilation
Phases : Implementation
Phases : System Configuration
Phases : System Configuration
Phases : Patching and Maintenance
Phases : Patching and Maintenance
Phases : Requirements

탐지 방법

Manual Analysis

효과성 : Moderate

Automated Analysis

효과성 : Moderate

Automated Analysis

효과성 : High

Fuzzing

Academic researchers have demonstrated that this weakness can be detected in hardware using software fuzzing tools that treat the underlying hardware as a black box ([REF-1406], [REF-1430])
효과성 : Opportunistic

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities
댓글 : If a weakness can potentially be exploited to infer data that is accessible inside or outside the current processor context, then the weakness could map to CWE-1421 and to another CWE such as CWE-1420.

참고 자료

REF-1404

Page Table Isolation (PTI)
The kernel development community.
https://kernel.org/doc/html/next/x86/pti.html

REF-1405

RIDL: Rogue In-Flight Data Load
Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Giorgi Maisuradze, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida.
https://mdsattacks.com/files/ridl.pdf

REF-1406

Downfall: Exploiting Speculative Data Gathering
Daniel Moghimi.
https://www.usenix.org/system/files/usenixsecurity23-moghimi.pdf

REF-1401

Hardware Security Leak Detection by Symbolic Simulation
Neta Bar Kama, Roope Kaivola.
https://ieeexplore.ieee.org/document/9617727

REF-1408

Meltdown: Reading Kernel Memory from User Space
Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Stefan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, Mike Hamburg.
https://meltdownattack.com/meltdown.pdf

REF-1409

Microarchitectural Data Sampling
Intel Corporation.
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/intel-analysis-microarchitectural-data-sampling.html

REF-1410

Cache Speculation Side-channels
ARM.
https://armkeil.blob.core.windows.net/developer/Files/pdf/Cache_Speculation_Side-channels.pdf

REF-1411

Rogue System Register Read/CVE-2018-3640/INTEL-SA-00115
Intel Corporation.
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/rogue-system-register-read.html

REF-1400

Refined Speculative Execution Terminology
Intel Corporation.
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/refined-speculative-execution-terminology.html

REF-1389

You Cannot Always Win the Race: Analyzing the LFENCE/JMP Mitigation for Branch Target Injection
Alyssa Milburn, Ke Sun, Henrique Kawakami.
https://arxiv.org/abs/2203.04277

REF-1430

Medusa: Microarchitectural: Data Leakage via Automated Attack Synthesis
Daniel Moghimi, Moritz Lipp, Berk Sunar, Michael Schwarz.
https://www.usenix.org/conference/usenixsecurity20/presentation/moghimi-medusa

REF-1417

InvisiSpec: making speculative execution invisible in the cache hierarchy.
Mengjia Yan, Jiho Choi, Dimitrios Skarlatos, Adam Morrison, Christopher W. Fletcher, Josep Torrella.
https://iacoma.cs.uiuc.edu/iacoma-papers/micro18.pdf

REF-1418

Port Contention for Fun and Profit
Alejandro Cabrera Aldaya, Billy Bob Brumley, Sohaib ul Hassan, Cesar Pereida García, Nicola Tuveri.
https://eprint.iacr.org/2018/1060.pdf

REF-1419

Speculative Interference Attacks: Breaking Invisible Speculation Schemes
Mohammad Behnia, Prateek Sahu, Riccardo Paccagnella, Jiyong Yu, Zirui Zhao, Xiang Zou, Thomas Unterluggauer, Josep Torrellas, Carlos Rozas, Adam Morrison, Frank Mckeen, Fangfei Liu, Ron Gabor, Christopher W. Fletcher, Abhishek Basak, Alaa Alameldeen.
https://arxiv.org/abs/2007.11818

REF-1420

Spectre is here to stay: An analysis of side-channels and speculative execution
Ross Mcilroy, Jaroslav Sevcik, Tobias Tebbi, Ben L. Titzer, Toon Verwaest.
https://arxiv.org/pdf/1902.05178

제출

수정 사항