CWE-1422 covers a processor event or prediction that forwards incorrect or stale data to transient operations, potentially exposing it over a covert channel.
It concerns processor designers and system software authors, and it matters for anyone who depends on sandboxes or language safety to keep one user's data from another.
How it happens
Software protects private data in several ways. Memory safe and type safe languages help. Sandboxes may put several users' code in one process and block access with techniques like bounds checking, even though the processor itself would allow it because they share an address space.
Transient execution undermines this. If a cache or another structure forwards incorrect or stale data to transient operations, the side effects of those operations can correspond to the data. An attacker who can trigger that, and observe the side effects, can recover information that the software defenses were meant to keep private.
Observed examples:
- CVE-2020-0551: a fault, microcode assist or abort may let transient loads forward malicious stale data to dependent operations run by a victim.
- CVE-2020-8698: a fast store forwarding predictor may allow stores to forward incorrect data to transient loads.
What an attacker gains
Reading memory, a confidentiality loss, rated medium likelihood in the record.
How to find it
- Automated static analysis. Tools can identify potentially exploitable code sequences in source, binary or intermediate code.
- Manual analysis. In hardware, inspect specifications for predictors and out of order access checks.
- Vendor tools. Tools can try to transiently execute a vulnerable sequence and see whether data leaks.
How to fix it
MITRE's list, with ratings:
- Isolate sandboxes and managed runtimes in separate processes. Rated high, and a strategy that helps against many other weakness kinds.
- Serialization instructions such as LFENCE. Rated moderate. They can add significant overhead if applied everywhere.
- Software techniques that lessen the consequences, such as address masking to prevent out of bounds transient reads. Rated limited.
- Reduce instructions executed transiently after an event or misprediction. Rated incidental, because some weaknesses are exploitable with a single transient instruction.
- Restrict unprivileged access to high resolution timers. Defense in depth.
- Hardware features to disable specific predictors, or to curb transient side effects. Limited, with performance cost.
Quick check
Why is process isolation rated so highly here?
It removes the shared address space that lets transient operations in one context reach another's data.
