名稱: Covert Storage Channel
A covert storage channel transfers information through the setting of bits by one program and the reading of those bits by another. What distinguishes this case from that of ordinary operation is that the bits are used to convey encoded information.
CWE 描述
Covert storage channels occur when out-of-band data is stored in messages for the purpose of memory reuse. Covert channels are frequently classified as either storage or timing channels. Examples would include using a file intended to hold only audit information to convey user passwords--using the name of a file or perhaps status bits associated with it that can be read by all users to signal the contents of the file. Steganography - concealing information in such a manner that no one but the intended recipient knows of the existence of the message - is a good example of a covert storage channel.
一般資訊
引入方式
Implementation適用平台
程式語言
類別： Not Language-Specific (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Confidentiality | Read Application Data 注意：Covert storage channels may provide attackers with important information about the system in question. | |
| Integrity Confidentiality | Read Application Data 注意：If these messages or packets are sent with unnecessary data contained within, it may tip off malicious listeners as to the process that created the message. With this information, attackers may learn any number of things, including the hardware platform, operating system, or algorithms used by the sender. This information can be of significant value to the user in launching further attacks. |
潛在緩解措施
Phases : ImplementationEnsure that all reserved fields are set to zero before messages are sent and that no unnecessary information is included.
漏洞對應備注
理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
備注
As of CWE 4.9, members of the CWE Hardware SIG are working to improve CWE's coverage of transient execution weaknesses, which include issues related to Spectre, Meltdown, and other attacks that create or exploit covert channels. As a result of that work, this entry might change in CWE 4.10.參考資料
REF-1431
A Taxonomy of Computer Program Security Flaws, with ExamplesCarl E. Landwehr, Alan R. Bull, John P. McDermott, William S. Choi.
https://cwe.mitre.org/documents/sources/ATaxonomyofComputerProgramSecurityFlawswithExamples%5BLandwehr93%5D.pdf
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| Landwehr | Draft 3 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Common_Consequences, Description | |
| CWE Content Team | MITRE | updated Other_Notes | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Maintenance_Notes | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated References | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Description |
