Hardware Logic with Insecure De-Synchronization between Control and Data Channels

Opis

The hardware logic for error handling and security checks can incorrectly forward data before the security check is complete.

Many high-performance on-chip bus protocols and processor data-paths employ separate channels for control and data to increase parallelism and maximize throughput. Bugs in the hardware logic that handle errors and security checks can make it possible for data to be forwarded before the completion of the security checks. If the data can propagate to a location in the hardware observable to an attacker, loss of data confidentiality can occur. 'Meltdown' is a concrete example of how de-synchronization between data and permissions checking logic can violate confidentiality requirements. Data loaded from a page marked as privileged was returned to the CPU regardless of current privilege level for performance reasons. The assumption was that the CPU could later remove all traces of this data during the handling of the illegal memory access exception, but this assumption was proven false as traces of the secret data were not removed from the microarchitectural state.

Skutki

• Confidentiality

  Read Memory; Read Application Data

Zapobieganie

• Architecture and Design

  Thoroughly verify the data routing logic to ensure that any error handling or security checks effectively block illegal dataflows.

Przykłady podatności

• CVE-2017-5754 Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

Słabość nadrzędna

• CWE-821 Incorrect Synchronization

Pokrewna

• CWE-1037 Processor Optimization Removal or Modification of Security-critical Code

Kiedy powstaje

• Architecture and Design — The weakness can be introduced in the data transfer or bus protocol itself or in the implementation.
• Implementation

Dotyczy

Not Language-Specific, Not OS-Specific, Not Architecture-Specific, Not Technology-Specific

Uwagi

As of CWE 4.9, members of the CWE Hardware SIG are closely analyzing this entry and others to improve CWE's coverage of transient execution weaknesses, which include issues related to Spectre, Meltdown, and other attacks. Additional investigation may include other weaknesses related to microarchitectural state. As a result, this entry might change significantly in CWE 4.10.