Tên: Non-Transparent Sharing of Microarchitectural Resources

Hardware structures shared across execution contexts (e.g., caches and branch predictors) can violate the expected architecture isolation between contexts.

Thông tin chung

Các cách xuất hiện

Architecture and Design : Such issues could be introduced during hardware architecture and design and identified later during Testing or System Configuration phases.
Implementation : Such issues could be introduced during implementation and identified later during Testing or System Configuration phases.

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)

Hệ điều hành

Lớp: Not OS-Specific (Undetermined)

Kiến trúc

Lớp: Not Architecture-Specific (Undetermined)

Công nghệ

Lớp: Not Technology-Specific (Undetermined)

Hậu quả phổ biến

Phạm vi	Tác động	Khả năng xảy ra
Confidentiality	Read Application Data, Read Memory Ghi chú: Microarchitectural side-channels have been used to leak specific information such as cryptographic keys, and Address Space Layout Randomization (ALSR) offsets as well as arbitrary memory.

Các biện pháp giảm thiểu tiềm năng

Phases : Architecture and Design
Microarchitectural covert channels can be addressed using a mixture of hardware and software mitigation techniques. These include partitioned caches, new barrier and flush instructions, and disabling high resolution performance counters and timers.
Phases : Requirements
Microarchitectural covert channels can be addressed using a mixture of hardware and software mitigation techniques. These include partitioned caches, new barrier and flush instructions, and disabling high resolution performance counters and timers.

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Mẫu tấn công liên quan

ID CAPEC	Tên mẫu tấn công
CAPEC-663	Exploitation of Transient Instruction Execution An adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution to expose sensitive data and bypass/subvert access control over restricted resources. Typically, the adversary conducts a covert channel attack to target non-discarded microarchitectural changes caused by transient executions such as speculative execution, branch prediction, instruction pipelining, and/or out-of-order execution. The transient execution results in a series of instructions (gadgets) which construct covert channel and access/transfer the secret data.

Ghi chú

As of CWE 4.9, members of the CWE Hardware SIG are closely analyzing this entry and others to improve CWE's coverage of transient execution weaknesses, which include issues related to Spectre, Meltdown, and other attacks. Additional investigation may include other weaknesses related to microarchitectural state. Finally, this entry's demonstrative example might not be appropriate. As a result, this entry might change significantly in CWE 4.10.

Tài liệu tham khảo

REF-1121

Meltdown: Reading Kernel Memory from User Space
Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stegfan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, Mike Hamberg.
https://meltdownattack.com/meltdown.pdf

REF-1122

Spectre Attacks: Exploiting Speculative Execution
Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders Fogh, Jann Horn, Stegfan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom, Mike Hamberg.
https://spectreattack.com/spectre.pdf

REF-1123

Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR
Dmitry Evtyushkin, Dmitry Ponomarev, Nael Abu-Ghazaleh.
https://ieeexplore.ieee.org/abstract/document/7783743/

REF-1124

A Survey of Microarchitectural Timing Attacks and Countermeasures on Contemporary Hardware
Qian Ge, Yuval Yarom, David Cock, Gernot Heiser.
https://eprint.iacr.org/2016/613.pdf

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
Nicole Fern	Cycuity (originally submitted as Tortuga Logic)	2020-05-08 +00:00	2020-08-20 +00:00	4.2

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
CWE Content Team	MITRE	2021-03-15 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2022-10-13 +00:00	updated Demonstrative_Examples, Maintenance_Notes
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes, Relationships
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities

Chi tiết CWE-1303

CWE-1303