BaseDraft

CWE-1303Non-Transparent Sharing of Microarchitectural Resources

Category: logic

Description

Hardware structures shared across execution contexts (e.g., caches and branch predictors) can violate the expected architecture isolation between contexts.

Common consequences· 1

  • Confidentiality — Read Application Data, Read Memory
    Microarchitectural side-channels have been used to leak specific information such as cryptographic keys, and Address Space Layout Randomization (ALSR) offsets as well as arbitrary memory.

Potential mitigations· 2

  • [Architecture and Design]Microarchitectural covert channels can be addressed using a mixture of hardware and software mitigation techniques. These include partitioned caches, new barrier and flush instructions, and disabling high resolution performance counters and timers.
  • [Requirements]Microarchitectural covert channels can be addressed using a mixture of hardware and software mitigation techniques. These include partitioned caches, new barrier and flush instructions, and disabling high resolution performance counters and timers.

Related CAPEC attack patterns· 1

CAPEC-663

References

  1. https://cwe.mitre.org/data/definitions/1303.html

Exploits (incoming)1

TypeTargetConfidenceTier
AttackPatternExploitation of Transient Instruction Executioncapec-663100%live

Compliance frameworks addressing this (incoming)1

TypeTargetConfidenceTier
ComplianceControlowasp_llm_top10-llm03100%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CWE
Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
CWE
Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
CWE
Information Exposure through Microarchitectural State after Transient Execution
CWE
Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution
CWE
Exposure of Sensitive Information during Transient Execution
CWE
Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
Sourced from MITRE CWE 4.20. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.