2284
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
<<put the information here>>
Medium
Detection Methods
Manual Analysis
This weakness can be detected in hardware by manually inspecting processor specifications.
Features that exhibit this weakness may include microarchitectural predictors, access control
checks that occur out-of-order, or any other features that can allow operations to execute without
committing to architectural state. Academic researchers have demonstrated that new hardware
weaknesses can be discovered by examining publicly available patent filings, for example
[REF-1405] and [REF-1406]. Hardware designers can also scrutinize aspects of the instruction
set architecture that have undefined behavior; these can become a focal point when applying
other detection methods.
Effectiveness = Moderate
CWE Version 4.14
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during
Transient Execution
CWE-1421: Exposure of Sensitive Information in Shared
Microarchitectural Structures during Transient Execution 2292
Manual analysis may not reveal all weaknesses in a processor specification and should be
combined with other detection methods to improve coverage.
Automated Analysis
This weakness can be detected (pre-discovery) in hardware by employing static or dynamic taint
analysis methods [REF-1401]. These methods can label data in one context (for example, kernel
data) and perform information flow analysis (or a simulation, etc.) to determine whether tainted
data can appear in another context (for example, user mode). Alternatively, stale or invalid
data in shared microarchitectural resources can be marked as tainted, and the taint analysis
framework can identify when transient operations encounter tainted data.
Effectiveness = Moderate
Automated static or dynamic taint analysis may not reveal all weaknesses in a processor
specification and should be combined with other detection methods to improve coverage.
Automated Analysis
Software vendors can release tools that detect presence of known weaknesses (post-discovery)
on a processor. For example, some of these tools can attempt to transiently execute a vulnerable
code sequence and detect whether code successfully leaks data in a manner consistent with
the weakness under test. Alternatively, some hardware vendors provide enumeration for the
presence of a weakness (or lack of a weakness). These enumeration bits can be checked and
reported by system software. For example, Linux supports these checks for many commodity
processors: $ cat /proc/cpuinfo | grep bugs | head -n 1 bugs : cpu_meltdown spectre_v1
spectre_v2 spec_store_bypass l1tf mds swapgs taa itlb_multihit srbds mmio_stale_data retbleed
Effectiveness = High
This method can be useful for detecting whether a processor if affected by known weaknesses,
but it may not be useful for detecting unknown weaknesses.
Fuzzing
Academic researchers have demonstrated that this weakness can be detected in hardware
using software fuzzing tools that treat the underlying hardware as a black box ([REF-1406],
[REF-1430])
Effectiveness = Opportunistic
Fuzzing may not reveal all weaknesses in a processor specification and should be combined with
other detection methods to improve coverage.
Potential Mitigations
Phase: Architecture and Design
Hardware designers may choose to engineer the processor's pipeline to prevent architecturally
restricted data from being used by operations that can execute transiently.
Effectiveness = High
Phase: Architecture and Design
Hardware designers may choose not to share microarchitectural resources that can contain
sensitive data, such as fill buffers and store buffers.
Effectiveness = Moderate
This can be highly effective at preventing this weakness from being exposed across different
SMT threads or different processor cores. It is generally less practical to isolate these resources
between different contexts (for example, user and kernel) that may execute on the same SMT
thread or processor core.
Phase: Architecture and Design
CWE Version 4.14
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during
Transient Execution
CWE-1421: Exposure of Sensitive Information in Shared
Microarchitectural Structures during Transient Execution