2284
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory Medium
Detection Methods
Automated Static Analysis
A variety of automated static analysis tools can identify potentially exploitable code sequences
in software. These tools may perform the analysis on source code, on binary code, or on an
intermediate code representation (for example, during compilation).
Effectiveness = Moderate
Automated static analysis may not reveal all weaknesses in a processor specification and should
be combined with other detection methods to improve coverage.
Manual Analysis
This weakness can be detected in hardware by manually inspecting processor specifications.
Features that exhibit this weakness may include microarchitectural predictors, access control
checks that occur out-of-order, or any other features that can allow operations to execute
without committing to architectural state.Hardware designers can also scrutinize aspects of the
instruction set architecture that have undefined behavior; these can become a focal point when
applying other detection methods.
Effectiveness = Moderate
Manual analysis may not reveal all weaknesses in a processor specification and should be
combined with other detection methods to improve coverage.
Automated Analysis
Software vendors can release tools that detect presence of known weaknesses on a processor.
For example, some of these tools can attempt to transiently execute a vulnerable code sequence
and detect whether code successfully leaks data in a manner consistent with the weakness
under test. Alternatively, some hardware vendors provide enumeration for the presence of a
weakness (or lack of a weakness). These enumeration bits can be checked and reported by
CWE Version 4.14
CWE-1422: Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient
Execution
CWE-1422: Exposure of Sensitive Information caused by
Incorrect Data Forwarding during Transient Execution