2307
• 0x13BE13BD - edx, then the first adc will load 32 bits from address m in the victim's
address space and add *m (the data loaded from) to the attacker-controlled base
address in edi. The second adc instruction accesses a location in memory whose
address corresponds to *m`.
4. The adversary uses a covert channel analysis technique such as Flush+Reload ([REF-1416])
to infer the value of the victim's private data *m.
Example 2:
BTI can also allow software in one execution context to maliciously train branch predictor entries
that can be used in another context. For example, on some processors user-mode software may
be able to train predictor entries that can also be used after transitioning into kernel mode, such as
after invoking a system call. This vulnerability does not necessarily require SMT and may instead
be performed in synchronous steps, though it does require the attacker to find an exploitable code
sequence in the victim's code, for example, in the kernel.
Observed Examples
Reference Description
CVE-2017-5754 (Branch Target Injection, BTI, Spectre v2). Shared microarchitectural indirect
branch predictor state may allow code to influence transient execution across a
process, VM, or privilege boundary, potentially exposing data that is accessible
beyond the boundary.
https://www.cve.org/CVERecord?id=CVE-2017-5754
CVE-2022-0001 (Branch History Injection, BHI, Spectre-BHB). Shared branch history state may
allow user-mode code to influence transient execution in the kernel, potentially
exposing kernel data over a covert channel.
https://www.cve.org/CVERecord?id=CVE-2022-0001
CVE-2021-33149 (RSB underflow, Retbleed). Shared return stack buffer state may allow code
that executes before a prediction barrier to influence transient execution after
the prediction barrier, potentially exposing data that is accessible beyond the
barrier over a covert channel.
https://www.cve.org/CVERecord?id=CVE-2021-33149
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
References
[REF-1414]Intel Corporation. "Retpoline: A Branch Target Injection Mitigation". 2022 August 2. <
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/
technical-documentation/retpoline-branch-target-injection-mitigation.html >.2023-02-13.
[REF-1415]Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas,
Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz and Yuval
Yarom. "Spectre Attacks: Exploiting Speculative Execution". 2019 May. < https://spectreattack.com/
spectre.pdf >.2024-02-14.
[REF-1416]Yuval Yarom and Katrina Falkner. "Flush+Reload: A High Resolution, Low Noise,
L3 Cache Side-Channel Attack". 2014. < https://www.usenix.org/system/files/conference/
usenixsecurity14/sec14-paper-yarom.pdf >.2023-02-13.
CWE Version 4.14
CWE-2: 7PK - Environment
CWE-2: 7PK - Environment