1220
it is good to use an algorithm that, among other things, stores a seeded cryptographic one-way
hash of the password, then compare the hashes, which will always be of the same length.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 968 SFP Secondary Cluster: Covert Channel 888 2404
MemberOf 1415 Comprehensive Categorization: Resource Control 1400 2544
Notes
Theoretical
A covert channel can be thought of as an emergent resource, meaning that it was not an
originally intended resource, however it exists due the application's behaviors.
Maintenance
As of CWE 4.9, members of the CWE Hardware SIG are working to improve CWE's coverage of
transient execution weaknesses, which include issues related to Spectre, Meltdown, and other
attacks that create or exploit covert channels. As a result of that work, this entry might change in
CWE 4.10.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Landwehr Covert Channel
Related Attack Patterns
CAPEC-ID Attack Pattern Name
463 Padding Oracle Crypto Attack
CWE-515: Covert Storage Channel
Weakness ID : 515
Structure : Simple
Abstraction : Base
Description
A covert storage channel transfers information through the setting of bits by one program and the
reading of those bits by another. What distinguishes this case from that of ordinary operation is that
the bits are used to convey encoded information.
Extended Description
Covert storage channels occur when out-of-band data is stored in messages for the purpose of
memory reuse. Covert channels are frequently classified as either storage or timing channels.
Examples would include using a file intended to hold only audit information to convey user
passwords--using the name of a file or perhaps status bits associated with it that can be read by all
users to signal the contents of the file. Steganography, concealing information in such a manner
that no one but the intended recipient knows of the existence of the message, is a good example of
a covert storage channel.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-515: Covert Storage Channel
CWE-515: Covert Storage Channel