Covert Channel

Opis

A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.

Typically the system has not given authorization for the transmission and has no knowledge of its occurrence.

Skutki

• Confidentiality, Access Control

  Read Application Data; Bypass Protection Mechanism

Słabość nadrzędna

• CWE-1229 Creation of Emergent Resource

Słabości podrzędne

• CWE-385 Covert Timing Channel
• CWE-515 Covert Storage Channel

Kiedy powstaje

• Implementation
• Operation

Dotyczy

Not Language-Specific

Uwagi

A covert channel can be thought of as an emergent resource, meaning that it was not an originally intended resource, however it exists due the application's behaviors.

As of CWE 4.9, members of the CWE Hardware SIG are working to improve CWE's coverage of transient execution weaknesses, which include issues related to Spectre, Meltdown, and other attacks that create or exploit covert channels. As a result of that work, this entry might change in CWE 4.10.

Źródła

1. A Taxonomy of Computer Program Security Flaws, with Examples — Carl E. Landwehr, Alan R. Bull, John P. McDermott, William S. Choi, 1993
2. State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation — Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy, 2014