2287
Processor designers may expose registers (for example, control registers or model-specific
registers) that allow privileged and/or user software to disable specific predictors or other
hardware features that can cause confidential data to be exposed during transient execution.
Effectiveness = Limited
Disabling specific predictors or other hardware features may result in significant performance
overhead.
Phase: Requirements
Processor designers, system software vendors, or other agents may choose to restrict the ability
of unprivileged software to access to high-resolution timers that are commonly used to monitor
covert channels.
Effectiveness = Defense in Depth
Specific software algorithms can be used by an attacker to compensate for a lack of a highresolution
time source [REF-1420].
Phase: Build and Compilation
Isolate sandboxes or managed runtimes in separate address spaces (separate processes). For
examples, see [REF-1421].
Effectiveness = High
Phase: Build and Compilation
Include serialization instructions (for example, LFENCE) that prevent processor events or
mis-predictions prior to the serialization instruction from causing transient execution after the
serialization instruction. For some weaknesses, a serialization instruction can also prevent a
processor event or a mis-prediction from occurring after the serialization instruction (for example,
CVE-2018-3639 can allow a processor to predict that a load will not depend on an older store;
a serialization instruction between the store and the load may allow the store to update memory
and prevent the prediction from happening at all).
Effectiveness = Moderate
When used to comprehensively mitigate a transient execution weakness (for example, by
inserting an LFENCE after every instruction in a program), serialization instructions can introduce
significant performance overhead. On the other hand, when used to mitigate only a relatively
small number of high-risk code sequences, serialization instructions may have a low or negligible
impact on performance.
Phase: Build and Compilation
Use control-flow integrity (CFI) techniques to constrain the behavior of instructions that redirect
the instruction pointer, such as indirect branch instructions.
Effectiveness = Moderate
Some CFI techniques may not be able to constrain transient execution, even though they are
effective at constraining architectural execution. Or they may be able to provide some additional
protection against a transient execution weakness, but without comprehensively mitigating the
weakness. For example, Clang-CFI provides strong architectural CFI properties and can make
some transient execution weaknesses more difficult to exploit [REF-1398].
Phase: Build and Compilation
If the weakness is exposed by a single instruction (or a small set of instructions), then the
compiler (or JIT, etc.) can be configured to prevent the affected instruction(s) from being
generated, and instead generate an alternate sequence of instructions that is not affected by the
weakness. One prominent example of this mitigation is retpoline ([REF-1414]).
Effectiveness = Limited
CWE Version 4.14
CWE-1420: Exposure of Sensitive Information during Transient Execution
CWE-1420: Exposure of Sensitive Information during Transient Execution