2297
[REF-1430]Daniel Moghimi, Moritz Lipp, Berk Sunar and Michael Schwarz. "Medusa:
Microarchitectural: Data Leakage via Automated Attack Synthesis". 2020 August. < https://
www.usenix.org/conference/usenixsecurity20/presentation/moghimi-medusa >.2024-02-27.
[REF-1417]Mengjia Yan, Jiho Choi, Dimitrios Skarlatos, Adam Morrison, Christopher W. Fletcher
and Josep Torrella. "InvisiSpec: making speculative execution invisible in the cache hierarchy.".
2019 May. < http://iacoma.cs.uiuc.edu/iacoma-papers/micro18.pdf >.2024-02-14.
[REF-1418]Alejandro Cabrera Aldaya, Billy Bob Brumley, Sohaib ul Hassan, Cesar Pereida
García and Nicola Tuveri. "Port Contention for Fun and Profit". 2019 May. < https://
eprint.iacr.org/2018/1060.pdf >.2024-02-14.
[REF-1419]Mohammad Behnia, Prateek Sahu, Riccardo Paccagnella, Jiyong Yu, Zirui Zhao,
Xiang Zou, Thomas Unterluggauer, Josep Torrellas, Carlos Rozas, Adam Morrison, Frank
Mckeen, Fangfei Liu, Ron Gabor, Christopher W. Fletcher, Abhishek Basak and Alaa Alameldeen.
"Speculative Interference Attacks: Breaking Invisible Speculation Schemes". 2021 April. < https://
arxiv.org/abs/2007.11818 >.2024-02-14.
[REF-1420]Ross Mcilroy, Jaroslav Sevcik, Tobias Tebbi, Ben L. Titzer and Toon Verwaest.
"Spectre is here to stay: An analysis of side-channels and speculative execution". 2019 February 4.
< https://arxiv.org/pdf/1902.05178.pdf >.2024-02-14.
CWE-1422: Exposure of Sensitive Information caused by Incorrect Data
Forwarding during Transient Execution
Weakness ID : 1422
Structure : Simple
Abstraction : Base
Description
A processor event or prediction may allow incorrect or stale data to be forwarded to transient
operations, potentially exposing data over a covert channel.
Extended Description
Software may use a variety of techniques to preserve the confidentiality of private data that is
accessible within the current processor context. For example, the memory safety and type safety
properties of some high-level programming languages help to prevent software written in those
languages from exposing private data. As a second example, software sandboxes may co-locate
multiple users' software within a single process. The processor's Instruction Set Architecture (ISA)
may permit one user's software to access another user's data (because the software shares the
same address space), but the sandbox prevents these accesses by using software techniques
such as bounds checking.
If incorrect or stale data can be forwarded (for example, from a cache) to transient operations,
then the operations' microarchitectural side effects may correspond to the data. If an attacker can
trigger these transient operations and observe their side effects through a covert channel, then
the attacker may be able to infer the data. For example, an attacker process may induce transient
execution in a victim process that causes the victim to inadvertently access and then expose its
private data via a covert channel. In the software sandbox example, an attacker sandbox may
induce transient execution in its own code, allowing it to transiently access and expose data in a
victim sandbox that shares the same address space.
Consequently, weaknesses that arise from incorrect/stale data forwarding might violate users'
expectations of software-based memory safety and isolation techniques. If the data forwarding
behavior is not properly documented by the hardware vendor, this might violate the software
vendor's expectation of how the hardware should behave.
CWE Version 4.14
CWE-1422: Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient
Execution
CWE-1422: Exposure of Sensitive Information caused by
Incorrect Data Forwarding during Transient Execution 2298
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1420 Exposure of Sensitive Information during Transient
Execution