2251
Architecture : x86 (Prevalence = Undetermined)
Architecture : ARM (Prevalence = Undetermined)
Architecture : Other (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : System on Chip (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Modify Memory
Read Memory
Execute Unauthorized Code or Commands
Medium
Potential Mitigations
Phase: Architecture and Design
Phase: Requirements
Hardware ensures that no illegal data flows from faulting micro-ops exists at the
microarchitectural level.
Effectiveness = High
Being implemented in silicon it is expected to fully address the known weaknesses with limited
performance impact.
Phase: Build and Compilation
Include instructions that explicitly remove traces of unneeded computations from software
interactions with microarchitectural elements e.g. lfence, sfence, mfence, clflush.
Effectiveness = High
This effectively forces the processor to complete each memory access before moving on to the
next operation. This may have a large performance impact.
Demonstrative Examples
Example 1:
Faulting loads in a victim domain may trigger incorrect transient forwarding, which leaves secretdependent
traces in the microarchitectural state. Consider this example from [REF-1203].
Consider the code gadget:
Example Language: C (Bad)
void call_victim(size_t untrusted_arg) {
*arg_copy = untrusted_arg;
array[**trusted_ptr * 4096];
}
A processor with this weakness will store the value of untrusted_arg (which may be provided by an
attacker) to the stack, which is trusted memory. Additionally, this store operation will save this value
in some microarchitectural buffer, e.g. the store queue.
In this code gadget, trusted_ptr is dereferenced while the attacker forces a page fault. The faulting
load causes the processor to mis-speculate by forwarding untrusted_arg as the (speculative) load
result. The processor then uses untrusted_arg for the pointer dereference. After the fault has been
handled and the load has been re-issued with the correct argument, secret-dependent information
stored at the address of trusted_ptr remains in microarchitectural state and can be extracted by an
attacker using a code gadget.
CWE Version 4.14
CWE-1351: Improper Handling of Hardware Behavior in Exceptionally Cold Environments
CWE-1351: Improper Handling of Hardware
Behavior in Exceptionally Cold Environments 2252
Observed Examples
Reference Description
CVE-2020-0551 Load value injection in some processors utilizing speculative execution may
allow an authenticated user to enable information disclosure via a side-channel
with local access.
https://www.cve.org/CVERecord?id=CVE-2020-0551
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1201 Core and Compute Issues 1194 2471
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Relationship
CWE-1342 differs from CWE-1303, which is related to misprediction and biasing
microarchitectural components, while CWE-1342 addresses illegal data flows and retention. For
example, Spectre is an instance of CWE-1303 biasing branch prediction to steer the transient
execution indirectly.
Maintenance
As of CWE 4.9, members of the CWE Hardware SIG are closely analyzing this entry and others
to improve CWE's coverage of transient execution weaknesses, which include issues related to
Spectre, Meltdown, and other attacks. Additional investigation may include other weaknesses
related to microarchitectural state. As a result, this entry might change significantly in CWE 4.10.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
696 Load Value Injection
References
[REF-1202]Jo Van Bulck, Daniel Moghimi, Michael Schwarz, Moritz Lipp, Marina Minkin, Daniel
Genkin, Yuval Yarom, Berk Sunar, Daniel Gruss, and Frank Piessens. "LVI - Hijacking Transient
Execution with Load Value Injection". 2020. < https://lviattack.eu/ >.
[REF-1203]Jo Van Bulck, Daniel Moghimi, Michael Schwarz, Moritz Lipp, Marina Minkin, Daniel
Genkin, Yuval Yarom, Berk Sunar, Daniel Gruss, and Frank Piessens. "LVI: Hijacking Transient
Execution through Microarchitectural Load Value Injection". 2020 January 9. < https://lviattack.eu/
lvi.pdf >.
[REF-1204]"Hijacking Transient Execution through Microarchitectural Load Value Injection". 2020
May 8. < https://www.youtube.com/watch?v=99kVz-YGi6Y >.
[REF-1205]Stephan van Schaik, Marina Minkin, Andrew Kwong, Daniel Genkin, Yuval Yarom.
"CacheOut: Leaking Data on Intel CPUs via Cache Evictions". 2020 December 8. < https://
cacheoutattack.com/files/CacheOut.pdf >.
CWE-1351: Improper Handling of Hardware Behavior in Exceptionally Cold
Environments
Weakness ID : 1351
Structure : Simple
CWE Version 4.14
CWE-1351: Improper Handling of Hardware Behavior in Exceptionally Cold Environments
CWE-1351: Improper Handling of Hardware
Behavior in Exceptionally Cold Environments