2284
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
CWE-1420: Exposure of Sensitive Information during Transient Execution
Weakness ID : 1420
Structure : Simple
Abstraction : Base
Description
A processor event or prediction may allow incorrect operations (or correct operations with incorrect
data) to execute transiently, potentially exposing data over a covert channel.
Extended Description
When operations execute but do not commit to the processor's architectural state, this is commonly
referred to as transient execution. This behavior can occur when the processor mis-predicts an
outcome (such as a branch target), or when a processor event (such as an exception or microcode
assist, etc.) is handled after younger operations have already executed. Operations that execute
transiently may exhibit observable discrepancies (CWE-203) in covert channels [REF-1400] such
as data caches. Observable discrepancies of this kind can be detected and analyzed using timing
or power analysis techniques, which may allow an attacker to infer information about the operations
that executed transiently. For example, the attacker may be able to infer confidential data that was
accessed or used by those operations.
Transient execution weaknesses may be exploited using one of two methods. In the first method,
the attacker generates a code sequence that exposes data through a covert channel when it is
executed transiently (the attacker must also be able to trigger transient execution). Some transient
execution weaknesses can only expose data that is accessible within the attacker's processor
context. For example, an attacker executing code in a software sandbox may be able to use a
transient execution weakness to expose data within the same address space, but outside of the
attacker's sandbox. Other transient execution weaknesses can expose data that is architecturally
inaccessible, that is, data protected by hardware-enforced boundaries such as page tables or
privilege rings. These weaknesses are the subject of CWE-1421.
In the second exploitation method, the attacker first identifies a code sequence in a victim program
that, when executed transiently, can expose data that is architecturally accessible within the
victim's processor context. For instance, the attacker may search the victim program for code
sequences that resemble a bounds-check bypass sequence (see Demonstrative Example 1). If the
attacker can trigger a mis-prediction of the conditional branch and influence the index of the outof-
bounds array access, then the attacker may be able to infer the value of out-of-bounds data by
monitoring observable discrepancies in a covert channel.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-1420: Exposure of Sensitive Information during Transient Execution
CWE-1420: Exposure of Sensitive Information during Transient Execution