CWE-1423 詳細資料

Shared microarchitectural predictor state may allow code to influence transient execution across a hardware boundary, potentially exposing data that is accessible beyond the boundary over a covert channel.

引入方式

Architecture and Design
Implementation
System Configuration

適用平台

程式語言

類別： Not Language-Specific (Undetermined)

作業系統

類別： Not OS-Specific (Undetermined)

架構

類別： Not Architecture-Specific (Undetermined)

技術

名稱： Microcontroller Hardware (Undetermined)
名稱： Processor Hardware (Undetermined)
名稱： Memory Hardware (Undetermined)
類別： System on Chip (Undetermined)

常見後果

觀察到的案例

潛在緩解措施

Phases : Architecture and Design
Phases : Architecture and Design
Phases : Architecture and Design
Phases : Implementation
Phases : Build and Compilation
Phases : Build and Compilation
Phases : Build and Compilation
Phases : System Configuration
Phases : Patching and Maintenance
Phases : Documentation
Phases : Requirements

偵測方法

Manual Analysis

有效性 : Moderate

Automated Analysis

有效性 : High

Automated Analysis

有效性 : Moderate

漏洞對應備注

理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities
備註 : Use only when the weakness allows code in one processor context to influence the predictions of code in another processor context via predictor state that is shared between the two contexts. For example, Branch Target Injection, an instance of CWE-1423, can be mitigated by tagging each indirect branch predictor entry according to the processor context in which the entry was created, thus preventing entries created in one context from being used in a different context. However, the mitigated indirect branch predictor can still expose different weaknesses where malicious predictor entries created in one context are used later in the same context (context tags cannot prevent this). One such example is Intra-mode Branch Target Injection. Weaknesses of this sort can map to CWE-1420.

參考資料

REF-1414

Retpoline: A Branch Target Injection Mitigation
Intel Corporation.
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/retpoline-branch-target-injection-mitigation.html

REF-1415

Spectre Attacks: Exploiting Speculative Execution
Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, Yuval Yarom.
https://spectreattack.com/spectre.pdf

REF-1416

Flush+Reload: A High Resolution, Low Noise, L3 Cache Side-Channel Attack
Yuval Yarom, Katrina Falkner.
https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-yarom.pdf

REF-1398

Control Flow Integrity
The Clang Team.
https://clang.llvm.org/docs/ControlFlowIntegrity.html

REF-1389

You Cannot Always Win the Race: Analyzing the LFENCE/JMP Mitigation for Branch Target Injection
Alyssa Milburn, Ke Sun, Henrique Kawakami.
https://arxiv.org/abs/2203.04277

REF-1400

Refined Speculative Execution Terminology
Intel Corporation.
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/refined-speculative-execution-terminology.html

REF-1401

Hardware Security Leak Detection by Symbolic Simulation
Neta Bar Kama, Roope Kaivola.
https://ieeexplore.ieee.org/document/9617727

提交

修改記錄