2295
may be able to transiently read kernel data before the check completes. This race condition is
demonstrated in the following code snippet from [REF-1408], with additional annotations:
Example Language: x86 Assembly (Bad)
1 ; rcx = kernel address, rbx = probe array
2 xor rax, rax # set rax to 0
3 retry:
4 mov al, byte [rcx] # attempt to read kernel memory
5 shl rax, 0xc # multiply result by page size (4KB)
6 jz retry # if the result is zero, try again
7 mov rbx, qword [rbx + rax] # transmit result over a cache covert channel
Vulnerable processors may return kernel data from a shared microarchitectural resource in line 4,
for example, from the processor's L1 data cache. Since this vulnerability involves a race condition,
the mov in line 4 may not always return kernel data (that is, whenever the check "wins" the race),
in which case this demonstration code re-attempts the access in line 6. The accessed data is
multiplied by 4KB, a common page size, to make it easier to observe via a cache covert channel
after the transmission in line 7. The use of cache covert channels to observe the side effects of
transient execution has been described in [REF-1408].
Example 2:
Many commodity processors share microarchitectural fill buffers between sibling hardware threads
on simultaneous multithreaded (SMT) processors. Fill buffers can serve as temporary storage for
data that passes to and from the processor's caches. Microarchitectural Fill Buffer Data Sampling
(MFBDS) is a vulnerability that can allow a hardware thread to access its sibling's private data in a
shared fill buffer. The access may be prohibited by the processor's ISA, but MFBDS can allow the
access to occur during transient execution, in particular during a faulting operation or an operation
that triggers a microcode assist.
More information on MFBDS can be found in [REF-1405] and [REF-1409].
Example 3:
Some processors may allow access to system registers (for example, system coprocessor registers
or model-specific registers) during transient execution. This scenario is depicted in the code
snippet below. Under ordinary operating circumstances, code in exception level 0 (EL0) is not
permitted to access registers that are restricted to EL1, such as TTBR0_EL1. However, on some
processors an earlier mis-prediction can cause the MRS instruction to transiently read the value in
an EL1 register. In this example, a conditional branch (line 2) can be mis-predicted as "not taken"
while waiting for a slow load (line 1). This allows MRS (line 3) to transiently read the value in the
TTBR0_EL1 register. The subsequent memory access (line 6) can allow the restricted register's
value to become observable, for example, over a cache covert channel.
Code snippet is from [REF-1410]. See also [REF-1411].
Example Language: x86 Assembly (Bad)
1 LDR X1, [X2] ; arranged to miss in the cache
2 CBZ X1, over ; This will be taken
3 MRS X3, TTBR0_EL1;
4 LSL X3, X3, #imm
5 AND X3, X3, #0xFC0
6 LDR X5, [X6,X3] ; X6 is an EL0 base address
7 over
Observed Examples
CWE Version 4.14
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during
Transient Execution
CWE-1421: Exposure of Sensitive Information in Shared
Microarchitectural Structures during Transient Execution 2296
Reference Description
CVE-2017-5715 A fault may allow transient user-mode operations to access kernel data cached
in the L1D, potentially exposing the data over a covert channel.
https://www.cve.org/CVERecord?id=CVE-2017-5715
CVE-2018-3615 A fault may allow transient non-enclave operations to access SGX enclave
data cached in the L1D, potentially exposing the data over a covert channel.
https://www.cve.org/CVERecord?id=CVE-2018-3615
CVE-2019-1135 A TSX Asynchronous Abort may allow transient operations to access
architecturally restricted data, potentially exposing the data over a covert
channel.
https://www.cve.org/CVERecord?id=CVE-2019-1135
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
References
[REF-1404]The kernel development community. "Page Table Isolation (PTI)". 2023 January 0. <
https://kernel.org/doc/html/next/x86/pti.html >.2024-02-13.
[REF-1405]Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Giorgi
Maisuradze, Kaveh Razavi, Herbert Bos and Cristiano Giuffrida. "RIDL: Rogue In-Flight Data
Load". 2019 May 9. < https://mdsattacks.com/files/ridl.pdf >.2024-02-13.
[REF-1406]Daniel Moghimi. "Downfall: Exploiting Speculative Data Gathering". 2023 August 9. <
https://www.usenix.org/system/files/usenixsecurity23-moghimi.pdf >.2024-02-13.
[REF-1401]Neta Bar Kama and Roope Kaivola. "Hardware Security Leak Detection by Symbolic
Simulation". 2021 November. < https://ieeexplore.ieee.org/document/9617727 >.2024-02-13.
[REF-1408]Moritz Lipp, Michael Schwarz, Daniel Gruss, Thomas Prescher, Werner Haas, Stefan
Mangard, Paul Kocher, Daniel Genkin, Yuval Yarom and Mike Hamburg. "Meltdown: Reading
Kernel Memory from User Space". 2020 May 1. < https://meltdownattack.com/meltdown.pdf
>.2024-02-13.
[REF-1409]Intel Corporation. "Microarchitectural Data Sampling". 2021 March 1. < https://
www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/
technical-documentation/intel-analysis-microarchitectural-data-sampling.html >.2024-02-13.
[REF-1410]ARM. "Cache Speculation Side-channels". 2018 January. < https://
armkeil.blob.core.windows.net/developer/Files/pdf/Cache_Speculation_Side-channels.pdf
>.2024-02-22.
[REF-1411]Intel Corporation. "Rogue System Register Read/CVE-2018-3640/INTEL-SA-00115".
2018 May 1. < https://www.intel.com/content/www/us/en/developer/articles/technical/softwaresecurity-
guidance/advisory-guidance/rogue-system-register-read.html >.2024-02-13.
[REF-1400]Intel Corporation. "Refined Speculative Execution Terminology". 2022 March 1. <
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/
best-practices/refined-speculative-execution-terminology.html >.2024-02-13.
[REF-1389]Alyssa Milburn, Ke Sun and Henrique Kawakami. "You Cannot Always Win the Race:
Analyzing the LFENCE/JMP Mitigation for Branch Target Injection". 2022 March 8. < https://
arxiv.org/abs/2203.04277 >.2024-02-22.
CWE Version 4.14
CWE-1422: Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient
Execution
CWE-1422: Exposure of Sensitive Information caused by
Incorrect Data Forwarding during Transient Execution