The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.

Comparison logic is used to compare a variety of objects including passwords, Message
Authentication Codes (MACs), and responses to verification challenges. When comparison logic is
implemented at a finer granularity (e.g., byte-by-byte comparison) and breaks in the case of a
comparison failure, an attacker can exploit this implementation to identify when exactly
the failure occurred. With multiple attempts, the attacker may be able to guesses the correct
password/response to challenge and elevate their privileges.

Primary

Resultant

Architecture and Design

Implementation

Confidentiality
Authorization
Bypass Protection Mechanism

Implementation

The hardware designer should ensure that comparison logic is implemented so as to compare in one operation instead in smaller chunks.

CVE-2019-10482
Smartphone OS uses comparison functions that are not in constant time, allowing side channels
https://www.cve.org/CVERecord?id=CVE-2019-10482

CVE-2019-10071
Java-oriented framework compares HMAC signatures using String.equals() instead of a constant-time algorithm, causing timing discrepancies
https://www.cve.org/CVERecord?id=CVE-2019-10071

CVE-2014-0984
Password-checking function in router terminates validation of a password entry when it encounters the first incorrect character, which allows remote attackers to obtain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.
https://www.cve.org/CVERecord?id=CVE-2014-0984

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE 4.16 removed a demonstrative example for a hardware module because it was inaccurate and unable to be adapted. The CWE team is developing an alternative.

Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi
Intel Corporation
2020-02-12
4.1
2020-02-24

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2021-07-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2022-10-13
updated Demonstrative_Examples

CWE Content Team
MITRE
2023-04-27
updated Observed_Examples, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Demonstrative_Examples, Observed_Examples

CWE Content Team
MITRE
2024-11-19
4.16
2024-11-19
updated Demonstrative_Examples, Maintenance_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Anders Nordstrom
Cycuity Inc.
2024-01-09
reported problems with the Verilog demonstrative example, leading to its removal from this entry