2305
This technique may not be able to mitigate weaknesses that arise from predictor state that is
shared across SMT threads. Sanitizing predictor state on context switches may also negatively
impact performance, either by removing predictor entries that could be reused when returning to
the previous context, or by slowing down the context switch itself.
Phase: Implementation
System software can mitigate this weakness by invoking predictor-state-sanitizing operations (for
example, the indirect branch prediction barrier on Intel x86) when switching from one context to
another, according to the hardware vendor's recommendations.
Effectiveness = Moderate
This technique may not be able to mitigate weaknesses that arise from predictor state shared
across SMT threads. Sanitizing predictor state may also negatively impact performance in some
circumstances.
Phase: Build and Compilation
If the weakness is exposed by a single instruction (or a small set of instructions), then the
compiler (or JIT, etc.) can be configured to prevent the affected instruction(s) from being
generated. One prominent example of this mitigation is retpoline ([REF-1414]).
Effectiveness = Limited
This technique is only effective for software that is compiled with this mitigation. Additionally, an
alternate instruction sequence may mitigate the weakness on some processors but not others,
even when the processors share the same ISA. For example, retpoline has been documented as
effective on some x86 processors, but not fully effective on other x86 processors.
Phase: Build and Compilation
Use control-flow integrity (CFI) techniques to constrain the behavior of instructions that redirect
the instruction pointer, such as indirect branch instructions.
Effectiveness = Moderate
Some CFI techniques may not be able to constrain transient execution, even though they are
effective at constraining architectural execution. Or they may be able to provide some additional
protection against a transient execution weakness, but without comprehensively mitigating the
weakness. For example, Clang-CFI provides strong architectural CFI properties and can make
some transient execution weaknesses more difficult to exploit [REF-1398].
Phase: Build and Compilation
Use software techniques (including the use of serialization instructions) that are intended to
reduce the number of instructions that can be executed transiently after a processor event or
misprediction.
Effectiveness = Incidental
Some transient execution weaknesses can be exploited even if a single instruction is executed
transiently after a processor event or mis-prediction. This mitigation strategy has many other
pitfalls that prevent it from eliminating this weakness entirely. For example, see [REF-1389].
Phase: System Configuration
Some systems may allow the user to disable predictor sharing. For example, this could be a
BIOS configuration, or a model-specific register (MSR) that can be configured by the operating
system or virtual machine monitor.
Effectiveness = Moderate
Disabling predictor sharing can negatively impact performance for some workloads that benefit
from shared predictor state.
Phase: Patching and Maintenance
CWE Version 4.14
CWE-1423: Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State
that Influences Transient Execution
CWE-1423: Exposure of Sensitive Information caused by Shared
Microarchitectural Predictor State that Influences Transient Execution 2306
The hardware vendor may provide a patch to, for example, sanitize predictor state when the
processor transitions to a different context, or to prevent predictor entries from being shared
across SMT threads. A patch may also introduce new ISA that allows software to toggle a
mitigation.
Effectiveness = Moderate
This mitigation may only be fully effective if the patch prevents predictor sharing across all
contexts that are affected by the weakness. Additionally, sanitizing predictor state and/or
preventing shared predictor state can negatively impact performance in some circumstances.
Phase: Documentation
If a hardware feature can allow microarchitectural predictor state to be shared between contexts,
SMT threads, or other architecturally defined boundaries, the hardware designer may opt to
disclose this behavior in architecture documentation. This documentation can inform users about
potential consequences and effective mitigations.
Effectiveness = High
Phase: Requirements
Processor designers, system software vendors, or other agents may choose to restrict the ability
of unprivileged software to access to high-resolution timers that are commonly used to monitor
covert channels.
Demonstrative Examples
Example 1:
Branch Target Injection (BTI) is a vulnerability that can allow an SMT hardware thread to
maliciously train the indirect branch predictor state that is shared with its sibling hardware thread. A
cross-thread BTI attack requires the attacker to find a vulnerable code sequence within the victim
software. For example, the authors of [REF-1415] identified the following code sequence in the
Windows library ntdll.dll:
Example Language: x86 Assembly (Bad)
adc edi,dword ptr [ebx+edx+13BE13BDh]
adc dl,byte ptr [edi]
...
indirect_branch_site:
jmp dword ptr [rsi] # at this point attacker knows edx, controls edi and ebx
To successfully exploit this code sequence to disclose the victim's private data, the attacker must
also be able to find an indirect branch site within the victim, where the attacker controls the values
in edi and ebx, and the attacker knows the value in edx as shown above at the indirect branch site.
A proof-of-concept cross-thread BTI attack might proceed as follows:
1. The attacker thread and victim thread must be co-scheduled on the same physical processor
core.
2. The attacker thread must train the shared branch predictor so that when the victim
thread reaches indirect_branch_site, the jmp instruction will be predicted to target
example_code_sequence instead of the correct architectural target. The training procedure
may vary by processor, and the attacker may need to reverse-engineer the branch predictor
to identify a suitable training algorithm.
3. This step assumes that the attacker can control some values in the victim program,
specifically the values in edi and ebx at indirect_branch_site. When the victim reaches
indirect_branch_site the processor will (mis)predict example_code_sequence as the target
and (transiently) execute the adc instructions. If the attacker chooses ebx so that `ebx = m
CWE Version 4.14
CWE-1423: Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State
that Influences Transient Execution
CWE-1423: Exposure of Sensitive Information caused by Shared
Microarchitectural Predictor State that Influences Transient Execution