1976
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Read Memory
Microarchitectural side-channels have been used to leak
specific information such as cryptographic keys, and
Address Space Layout Randomization (ALSR) offsets as
well as arbitrary memory.
Potential Mitigations
Phase: Architecture and Design
Microarchitectural covert channels can be addressed using a mixture of hardware and software
mitigation techniques. These include partitioned caches, new barrier and flush instructions, and
disabling high resolution performance counters and timers.
Phase: Requirements
Microarchitectural covert channels can be addressed using a mixture of hardware and software
mitigation techniques. These include partitioned caches, new barrier and flush instructions, and
disabling high resolution performance counters and timers.
Demonstrative Examples
Example 1:
On some processors the hardware indirect branch predictor is shared between execution contexts,
for example, between sibling SMT threads. When SMT thread A executes an indirect branch
to a target address X, this target may be temporarily stored by the indirect branch predictor.
A subsequent indirect branch mis-prediction for SMT thread B could speculatively execute
instructions at X (or at a location in B's address space that partially aliases X). Even though the
processor rolls back the architectural effects of the mis-predicted indirect branch, the memory
accesses alter data cache state, which is not rolled back after the indirect branch is resolved.
CWE Version 4.14
CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/
Restore Operation
CWE-1304: Improperly Preserved Integrity of Hardware
Configuration State During a Power Save/Restore Operation 2176
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1198 Privilege Separation and Access Control Issues 1194 2470
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1418 Comprehensive Categorization: Violation of Secure
Design Principles
1400 2549
Notes
Maintenance
As of CWE 4.9, members of the CWE Hardware SIG are closely analyzing this entry and others
to improve CWE's coverage of transient execution weaknesses, which include issues related to
Spectre, Meltdown, and other attacks. Additional investigation may include other weaknesses
related to microarchitectural state. Finally, this entry's demonstrative example might not be
appropriate. As a result, this entry might change significantly in CWE 4.10.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
663 Exploitation of Transient Instruction Execution
References
[REF-1121]Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas,
Anders Fogh, Jann Horn, Stegfan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom and Mike
Hamberg. "Meltdown: Reading Kernel Memory from User Space". 2018 January 3. < https://
meltdownattack.com/meltdown.pdf >.
[REF-1122]Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Anders
Fogh, Jann Horn, Stegfan Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom and Mike Hamberg.
"Spectre Attacks: Exploiting Speculative Execution". 2018 January 3. < https://spectreattack.com/
spectre.pdf >.
[REF-1123]Dmitry Evtyushkin, Dmitry Ponomarev and Nael Abu-Ghazaleh. "Jump Over ASLR:
Attacking Branch Predictors to Bypass ASLR". 2016 October 9. < https://ieeexplore.ieee.org/
abstract/document/7783743/ >.
[REF-1124]Qian Ge, Yuval Yarom, David Cock and Gernot Heiser. "A Survey of Microarchitectural
Timing Attacks and Countermeasures on Contemporary Hardware". 2016 October 4. < https://
eprint.iacr.org/2016/613.pdf >.
CWE-1304: Improperly Preserved Integrity of Hardware Configuration State
During a Power Save/Restore Operation
Weakness ID : 1304
Structure : Simple
Abstraction : Base
Description
The product performs a power save/restore operation, but it does not ensure that the integrity
of the configuration state is maintained and/or verified between the beginning and ending of the
operation.
Extended Description
CWE Version 4.14
CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/
Restore Operation
CWE-1304: Improperly Preserved Integrity of Hardware
Configuration State During a Power Save/Restore Operation