Szczegóły CWE-1342

CWE-1342

Information Exposure through Microarchitectural State after Transient Execution
Incomplete
2021-10-28
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Powiadomienia dla konkretnego CWE
Bądź na bieżąco z wszelkimi zmianami dotyczącymi konkretnego CWE.
Zarządzaj powiadomieniami

Nazwa: Information Exposure through Microarchitectural State after Transient Execution

The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution.

Informacje ogólne

Sposoby wprowadzenia

Architecture and Design
Requirements

Odpowiednie platformy

Język

Class: Not Language-Specific (Undetermined)

Systemy operacyjne

Class: Not OS-Specific (Undetermined)

Architektury

Class: Workstation (Undetermined)
Name: x86 (Undetermined)
Name: ARM (Undetermined)
Name: Other (Undetermined)

Technologie

Class: Not Technology-Specific (Undetermined)
Class: System on Chip (Undetermined)

Typowe konsekwencje

Zakres Wpływ Prawdopodobieństwo
Confidentiality
Integrity		Modify Memory, Read Memory, Execute Unauthorized Code or CommandsMedium

Zaobserwowane przykłady

Odniesienia Opis

CVE-2020-0551

Load value injection in some processors utilizing speculative execution may allow an authenticated user to enable information disclosure via a side-channel with local access.

Potencjalne środki zaradcze

Phases : Architecture and Design // Requirements
Hardware ensures that no illegal data flows from faulting micro-ops exists at the microarchitectural level.
Phases : Build and Compilation
Include instructions that explicitly remove traces of unneeded computations from software interactions with microarchitectural elements e.g. lfence, sfence, mfence, clflush.

Uwagi dotyczące mapowania podatności

Uzasadnienie : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentarz : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Powiązane wzorce ataków

CAPEC-ID Nazwa wzorca ataku
CAPEC-696 Load Value Injection
An adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution in which a faulting or assisted load instruction transiently forwards adversary-controlled data from microarchitectural buffers. By inducing a page fault or microcode assist during victim execution, an adversary can force legitimate victim execution to operate on the adversary-controlled data which is stored in the microarchitectural buffers. The adversary can then use existing code gadgets and side channel analysis to discover victim secrets that have not yet been flushed from microarchitectural state or hijack the system control flow.

Notatki

CWE-1342 differs from CWE-1303, which is related to misprediction and biasing microarchitectural components, while CWE-1342 addresses illegal data flows and retention. For example, Spectre is an instance of CWE-1303 biasing branch prediction to steer the transient execution indirectly.
As of CWE 4.9, members of the CWE Hardware SIG are closely analyzing this entry and others to improve CWE's coverage of transient execution weaknesses, which include issues related to Spectre, Meltdown, and other attacks. Additional investigation may include other weaknesses related to microarchitectural state. As a result, this entry might change significantly in CWE 4.10.

Odniesienia

REF-1202

LVI - Hijacking Transient Execution with Load Value Injection
Jo Van Bulck, Daniel Moghimi, Michael Schwarz, Moritz Lipp, Marina Minkin, Daniel Genkin, Yuval Yarom, Berk Sunar, Daniel Gruss, and Frank Piessens.
https://lviattack.eu/

REF-1203

LVI: Hijacking Transient Execution through Microarchitectural Load Value Injection
Jo Van Bulck, Daniel Moghimi, Michael Schwarz, Moritz Lipp, Marina Minkin, Daniel Genkin, Yuval Yarom, Berk Sunar, Daniel Gruss, and Frank Piessens.
https://lviattack.eu/lvi.pdf

REF-1204

Hijacking Transient Execution through Microarchitectural Load Value Injection
https://www.youtube.com/watch?v=99kVz-YGi6Y

REF-1205

CacheOut: Leaking Data on Intel CPUs via Cache Evictions
Stephan van Schaik, Marina Minkin, Andrew Kwong, Daniel Genkin, Yuval Yarom.
https://cacheoutattack.com/files/CacheOut.pdf

Zgłoszenie

Nazwa Organizacja Data Data wydania Version
Anders Nordstrom, Alric Althoff Cycuity (originally submitted as Tortuga Logic) 2021-09-22 +00:00 2021-10-28 +00:00 4.6

Modyfikacje

Nazwa Organizacja Data Komentarz
CWE Content Team MITRE 2022-10-13 +00:00 updated Demonstrative_Examples, Maintenance_Notes, Related_Attack_Patterns
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2024-02-29 +00:00 updated Description
CWE Content Team MITRE 2025-12-11 +00:00 updated Weakness_Ordinalities
Informacje prezentowane na CVE Find pochodzą z kilku starannie wybranych źródeł referencyjnych. Dane CVE są dostarczane przez MITRE Corporation i Narodową Bazę Podatności (NVD). Katalog znanych eksploatowanych podatności (KEV) pochodzi z Agencji ds. Bezpieczeństwa Cyberprzestrzeni i Infrastruktury (CISA), natomiast wyniki EPSS pochodzą z FIRST.org. Ponadto dane dotyczące słabości oprogramowania (CWE) i typowych wzorców ataków (CAPEC) są utrzymywane przez MITRE Corporation, a informacje o konfiguracjach sprzętu i oprogramowania (CPE) są dostarczane przez NVD.