2289
execute the stale code that had been overwritten. This can happen, for instance, when the
processor issues a store that overwrites a sequence of code, but the processor fetches and
executes the (stale) code before the store updates memory. Similar to the first example, the
processor does not commit the stale code's architectural effects, though microarchitectural side
effects can persist. Hence, confidential information accessed or used by the stale code may be
inferred via an observable discrepancy in a covert channel. This vulnerability is described in more
detail in [REF-1427].
Observed Examples
Reference Description
CVE-2017-5753 Microarchitectural conditional branch predictors may allow operations to
execute transiently after a misprediction, potentially exposing data over a
covert channel.
https://www.cve.org/CVERecord?id=CVE-2017-5753
CVE-2021-0089 A machine clear triggered by self-modifying code may allow incorrect
operations to execute transiently, potentially exposing data over a covert
channel.
https://www.cve.org/CVERecord?id=CVE-2021-0089
CVE-2022-0002 Microarchitectural indirect branch predictors may allow incorrect operations
to execute transiently after a misprediction, potentially exposing data over a
covert channel.
https://www.cve.org/CVERecord?id=CVE-2022-0002
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1198 Privilege Separation and Access Control Issues 1194 2470
MemberOf 1201 Core and Compute Issues 1194 2471
MemberOf 1202 Memory and Storage Issues 1194 2472
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
References
[REF-1389]Alyssa Milburn, Ke Sun and Henrique Kawakami. "You Cannot Always Win the Race:
Analyzing the LFENCE/JMP Mitigation for Branch Target Injection". 2022 March 8. < https://
arxiv.org/abs/2203.04277 >.2024-02-22.
[REF-1417]Mengjia Yan, Jiho Choi, Dimitrios Skarlatos, Adam Morrison, Christopher W. Fletcher
and Josep Torrella. "InvisiSpec: making speculative execution invisible in the cache hierarchy.".
2019 May. < http://iacoma.cs.uiuc.edu/iacoma-papers/micro18.pdf >.2024-02-14.
[REF-1418]Alejandro Cabrera Aldaya, Billy Bob Brumley, Sohaib ul Hassan, Cesar Pereida
García and Nicola Tuveri. "Port Contention for Fun and Profit". 2019 May. < https://
eprint.iacr.org/2018/1060.pdf >.2024-02-14.
[REF-1419]Mohammad Behnia, Prateek Sahu, Riccardo Paccagnella, Jiyong Yu, Zirui Zhao,
Xiang Zou, Thomas Unterluggauer, Josep Torrellas, Carlos Rozas, Adam Morrison, Frank
Mckeen, Fangfei Liu, Ron Gabor, Christopher W. Fletcher, Abhishek Basak and Alaa Alameldeen.
"Speculative Interference Attacks: Breaking Invisible Speculation Schemes". 2021 April. < https://
arxiv.org/abs/2007.11818 >.2024-02-14.
[REF-1420]Ross Mcilroy, Jaroslav Sevcik, Tobias Tebbi, Ben L. Titzer and Toon Verwaest.
"Spectre is here to stay: An analysis of side-channels and speculative execution". 2019 February 4.
< https://arxiv.org/pdf/1902.05178.pdf >.2024-02-14.
CWE Version 4.14
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during
Transient Execution
CWE-1421: Exposure of Sensitive Information in Shared
Microarchitectural Structures during Transient Execution 2290
[REF-1421]Intel Corporation. "Managed Runtime Speculative Execution Side Channel Mitigations".
2018 January 3. < https://www.intel.com/content/www/us/en/developer/articles/technical/softwaresecurity-
guidance/technical-documentation/runtime-speculative-side-channel-mitigations.html
>.2024-02-14.
[REF-1398]The Clang Team. "Control Flow Integrity". < https://clang.llvm.org/docs/
ControlFlowIntegrity.html >.2024-02-13.
[REF-1414]Intel Corporation. "Retpoline: A Branch Target Injection Mitigation". 2022 August 2. <
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/
technical-documentation/retpoline-branch-target-injection-mitigation.html >.2023-02-13.
[REF-1390]The kernel development community. "Speculation". 2020 August 6. < https://
docs.kernel.org/6.6/staging/speculation.html >.2024-02-04.
[REF-1425]Chandler Carruth. "Speculative Load Hardening". < https://llvm.org/docs/
SpeculativeLoadHardening.html >.2024-02-14.
[REF-1427]Hany Ragab, Enrico Barberis, Herbert Bos and Cristiano Giuffrida. "Rage Against the
Machine Clear: A Systematic Analysis of Machine Clears and Their Implications for Transient
Execution Attacks". 2021 August. < https://www.usenix.org/system/files/sec21-ragab.pdf
>.2024-02-14.
[REF-1428]Oleksii Oleksenko, Marco Guarnieri, Boris Köpf and Mark Silberstein. "Hide and Seek
with Spectres: Efficient discovery of speculative information leaks with random testing". 2023
January 8. < https://arxiv.org/pdf/2301.07642.pdf >.2024-02-14.
[REF-1429]Oleksii Oleksenko, Bohdan Trach, Mark Silberstein and Christof Fetzer. "SpecFuzz:
Bringing Spectre-type vulnerabilities to the surface". 2020 August. < https://www.usenix.org/
system/files/sec20-oleksenko.pdf >.2024-02-14.
[REF-1415]Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas,
Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz and Yuval
Yarom. "Spectre Attacks: Exploiting Speculative Execution". 2019 May. < https://spectreattack.com/
spectre.pdf >.2024-02-14.
[REF-1400]Intel Corporation. "Refined Speculative Execution Terminology". 2022 March 1. <
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/
best-practices/refined-speculative-execution-terminology.html >.2024-02-13.
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural
Structures during Transient Execution
Weakness ID : 1421
Structure : Simple
Abstraction : Base
Description
A processor event may allow transient operations to access architecturally restricted data (for
example, in another address space) in a shared microarchitectural structure (for example, a CPU
cache), potentially exposing the data over a covert channel.
Extended Description
Many commodity processors have Instruction Set Architecture (ISA) features that protect software
components from one another. These features can include memory segmentation, virtual memory,
privilege rings, trusted execution environments, and virtual machines, among others. For example,
virtual memory provides each process with its own address space, which prevents processes
from accessing each other's private data. Many of these features can be used to form hardwareenforced
security boundaries between software components.
CWE Version 4.14
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during
Transient Execution
CWE-1421: Exposure of Sensitive Information in Shared
Microarchitectural Structures during Transient Execution