CWE-1423: Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution

Description:
Shared microarchitectural predictor state may allow code to influence
				transient execution across a hardware boundary, potentially exposing
				data that is accessible beyond the boundary over a covert channel.

Extended Description:
Many commodity processors have Instruction Set Architecture (ISA)
				features that protect software components from one another. These
				features can include memory segmentation, virtual memory, privilege
				rings, trusted execution environments, and virtual machines, among
				others. For example, virtual memory provides each process with its own
				address space, which prevents processes from accessing each other's
				private data. Many of these features can be used to form
				hardware-enforced security boundaries between software components. 
				 When separate software components (for example, two processes) share
				microarchitectural predictor state across a hardware boundary, code in
				one component may be able to influence microarchitectural predictor
				behavior in another component. If the predictor can cause transient
				execution, the shared predictor state may allow an attacker to
				influence transient execution in a victim, and in a manner that could
				all

Affected languages: Not Language-Specific
Affected technologies: Microcontroller Hardware, Processor Hardware, Memory Hardware, System on Chip
Parent weaknesses: CWE-1420, CWE-1420

Consequences:
  - Confidentiality: Read Memory

Detection methods:
  - Manual Analysis: This weakness can be detected in hardware by manually
					inspecting processor specifications. Features that exhibit this
					weakness may have microarchitectural predictor state that is shared
				
  - Automated Analysis: Software vendors can release tools that detect presence of
					known weaknesses on a processor. For example, some of these tools can
					attempt to transiently execute a vulnerable code sequence and
  - Automated Analysis: This weakness can be detected in hardware by employing static
					or dynamic taint analysis methods [REF-1401]. These methods can label
					each predictor entry (or prediction history, etc.) accordi

Mitigations:
  - [Architecture and Design] The hardware designer can attempt to prevent transient
					execution from causing observable discrepancies in specific covert
					channels.
  - [Architecture and Design] Hardware designers may choose to use microarchitectural
					bits to tag predictor entries. For example, each predictor entry may
					be tagged with a kernel-mode bit which, when set, indicates that the
					predictor entry was created in kernel mode. The processor can use this
					bit to enforce 
  - [Architecture and Design] Hardware designers may choose to sanitize
					microarchitectural predictor state (for example, branch prediction
					history) when the processor transitions to a different context, for
					example, whenever a system call is invoked. Alternatively, the
					hardware may expose instruction(s) that 
  - [Implementation] System software can mitigate this weakness by invoking
					predictor-state-sanitizing operations (for example, the indirect
					branch prediction barrier on Intel x86) when switching from one
					context to another, according to the hardware vendor's
					recommendations.

Demonstrative examples:
Branch Target Injection (BTI) is a vulnerability that can allow an SMT
					hardware thread to maliciously train the indirect branch predictor
					state that is shared with its sibling hardware thread. A cross-thread
					BTI attack requires the attacker to find a vulnerable code sequence
					within the victim software. For example, the authors of [REF-1415]
					identified the following code sequence in the Windows library
					ntdll.dll:
To successfully exploit this code sequence to disclose the victim's
					private data, the attacker must also be able to find an indirect
					branch site within the victim, where the attacker controls the values
					in edi and ebx, and the attacker knows the value in edx as shown above
					at the indirect branch site. 
					 A proof-of-concept cross

BTI can also allow software in one execution context to maliciously
					train branch predictor entries that can be used in another
					context. For example, on some processors user-mode software may be
					able to train predictor entries that can also be used after
					transitioning into kernel mode, such as after invoking a system
					call. This vulnerability does not necessarily require SMT and may
					instead be performed in synchronous steps, though it does require the
					attacker to find an exploitable code sequence in the victim's code,
					for example, in the kernel.

Real-world examples:
  - CVE-2017-5754: (Branch Target Injection, BTI, Spectre v2). Shared
					microarchitectural indirect branch predictor state may allow code to
					influence transient execution across a process, VM, or privilege
					
  - CVE-2022-0001: (Branch History Injection, BHI, Spectre-BHB). Shared
					branch history state may allow user-mode code to influence transient
					execution in the kernel, potentially exposing kernel data over a
			
  - CVE-2021-33149: (RSB underflow, Retbleed). Shared return stack buffer
					state may allow code that executes before a prediction barrier to
					influence transient execution after the prediction barrier,
					poten