2293
Hardware designers may choose to sanitize specific microarchitectural state (for example,
store buffers) when the processor transitions to a different context, such as whenever a system
call is invoked. Alternatively, the hardware may expose instruction(s) that allow software to
sanitize microarchitectural state according to the user or system administrator's threat model.
These mitigation approaches are similar to those that address CWE-226; however, sanitizing
microarchitectural state may not be the optimal or best way to mitigate this weakness on every
processor design.
Effectiveness = Moderate
Sanitizing shared state on context transitions may not be practical for all processors, especially
when the amount of shared state affected by the weakness is relatively large. Additionally, this
technique may not be practical unless there is a synchronous transition between two processor
contexts that would allow the affected resource to be sanitized. For example, this technique
alone may not suffice to mitigate asynchronous access to a resource that is shared by two SMT
threads.
Phase: Architecture and Design
The hardware designer can attempt to prevent transient execution from causing observable
discrepancies in specific covert channels.
Effectiveness = Limited
This technique has many pitfalls. For example, InvisiSpec was an early attempt to mitigate this
weakness by blocking "micro-architectural covert and side channels through the multiprocessor
data cache hierarchy due to speculative loads" [REF-1417]. Commodity processors and SoCs
have many covert and side channels that exist outside of the data cache hierarchy. Even when
some of these channels are blocked, others (such as execution ports [REF-1418]) may allow an
attacker to infer confidential data. Mitigation strategies that attempt to prevent transient execution
from causing observable discrepancies also have other pitfalls, for example, see [REF-1419].
Phase: Architecture and Design
Software architects may design software to enforce strong isolation between different contexts.
For example, kernel page table isolation (KPTI) mitigates the Meltdown vulnerability [REF-1401]
by separating user-mode page tables from kernel-mode page tables, which prevents user-mode
processes from using Meltdown to transiently access kernel memory [REF-1404].
Effectiveness = Limited
Isolating different contexts across a process boundary (or another kind of architectural boundary)
may only be effective for some weaknesses.
Phase: Build and Compilation
If the weakness is exposed by a single instruction (or a small set of instructions), then the
compiler (or JIT, etc.) can be configured to prevent the affected instruction(s) from being
generated, and instead generate an alternate sequence of instructions that is not affected by the
weakness.
Effectiveness = Limited
This technique may only be fully effective if it is applied to all software that runs on the system.
Also, relatively few observed examples of this weakness have exposed data through only a
single instruction.
Phase: Build and Compilation
Use software techniques (including the use of serialization instructions) that are intended to
reduce the number of instructions that can be executed transiently after a processor event or
misprediction.
Effectiveness = Incidental
CWE Version 4.14
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during
Transient Execution
CWE-1421: Exposure of Sensitive Information in Shared
Microarchitectural Structures during Transient Execution 2294
Some transient execution weaknesses can be exploited even if a single instruction is executed
transiently after a processor event or mis-prediction. This mitigation strategy has many other
pitfalls that prevent it from eliminating this weakness entirely. For example, see [REF-1389].
Phase: Implementation
System software can mitigate this weakness by invoking state-sanitizing operations when
switching from one context to another, according to the hardware vendor's recommendations.
Effectiveness = Limited
This technique may not be able to mitigate weaknesses that arise from resource sharing across
SMT threads.
Phase: System Configuration
Some systems may allow the user to disable (for example, in the BIOS) sharing of the affected
resource.
Effectiveness = Limited
Disabling resource sharing (for example, by disabling SMT) may result in significant performance
overhead.
Phase: System Configuration
Some systems may allow the user to disable (for example, in the BIOS) microarchitectural
features that allow transient access to architecturally restricted data.
Effectiveness = Limited
Disabling microarchitectural features such as predictors may result in significant performance
overhead.
Phase: Patching and Maintenance
The hardware vendor may provide a patch to sanitize the affected shared microarchitectural
state when the processor transitions to a different context.
Effectiveness = Moderate
This technique may not be able to mitigate weaknesses that arise from resource sharing across
SMT threads.
Phase: Patching and Maintenance
This kind of patch may not be feasible or implementable for all processors or all weaknesses.
Effectiveness = Limited
Phase: Requirements
Processor designers, system software vendors, or other agents may choose to restrict the ability
of unprivileged software to access to high-resolution timers that are commonly used to monitor
covert channels.
Effectiveness = Defense in Depth
Specific software algorithms can be used by an attacker to compensate for a lack of a highresolution
time source [REF-1420].
Demonstrative Examples
Example 1:
Some processors may perform access control checks in parallel with memory read/write
operations. For example, when a user-mode program attempts to read data from memory, the
processor may also need to check whether the memory address is mapped into user space or
kernel space. If the processor performs the access concurrently with the check, then the access
CWE Version 4.14
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during
Transient Execution
CWE-1421: Exposure of Sensitive Information in Shared
Microarchitectural Structures during Transient Execution