CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution

Description:
A processor event may allow transient operations to access
			architecturally restricted data (for example, in another address
			space) in a shared microarchitectural structure (for example, a CPU
			cache), potentially exposing the data over a covert channel.

Extended Description:
Many commodity processors have Instruction Set Architecture (ISA)
			features that protect software components from one another. These
			features can include memory segmentation, virtual memory, privilege
			rings, trusted execution environments, and virtual machines, among
			others. For example, virtual memory provides each process with its own
			address space, which prevents processes from accessing each other's
			private data. Many of these features can be used to form
			hardware-enforced security boundaries between software components. 
			 Many commodity processors also share microarchitectural resources that
			cache (temporarily store) data, which may be confidential. These
			resources may be shared across processor contexts, including across
			SMT threads, privilege rings, or others. 
			 When transient operations allow access to ISA-protected data in a
			shared microarchitectural resource, this might violate users'
			expectations of the ISA feature that is bypassed. F

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-1420, CWE-1420

Consequences:
  - Confidentiality: Read Memory

Detection methods:
  - Manual Analysis: This weakness can be detected in hardware by
				manually inspecting processor specifications. Features that exhibit
				this weakness may include microarchitectural predictors, access
				control che
  - Automated Analysis: This weakness can be detected (pre-discovery) in hardware by
				employing static or dynamic taint analysis methods [REF-1401]. These
				methods can label data in one context (for example, kernel dat
  - Automated Analysis: Software vendors can release tools that detect
				presence of known weaknesses (post-discovery) on a processor. For example, some of
				these tools can attempt to transiently execute a vulnerable co
  - Fuzzing: Academic researchers have demonstrated that this
				weakness can be detected in hardware using software fuzzing
				tools that treat the underlying hardware as a black box
				([REF-1406], [REF-1430]

Mitigations:
  - [Architecture and Design] Hardware designers may choose to engineer the processor's
				pipeline to prevent architecturally restricted data from being used by
				operations that can execute transiently.
  - [Architecture and Design] Hardware designers may choose not to share
				microarchitectural resources that can contain sensitive data, such as
				fill buffers and store buffers.
  - [Architecture and Design] Hardware designers may choose to sanitize specific
				microarchitectural state (for example, store buffers) when the
				processor transitions to a different context, such as whenever a
				system call is invoked. Alternatively, the hardware may expose
				instruction(s) that allow software to sani
  - [Architecture and Design] The hardware designer can attempt to prevent transient
				execution from causing observable discrepancies in specific covert
				channels.

Demonstrative examples:
Some processors may perform access control checks in parallel with
				memory read/write operations. For example, when a user-mode program
				attempts to read data from memory, the processor may also need to
				check whether the memory address is mapped into user space or kernel
				space. If the processor performs the access concurrently with the
				check, then the access may be able to transiently read kernel data
				before the check completes. This race condition is demonstrated in the
				following code snippet from [REF-1408], with additional annotations:
Vulnerable processors may return kernel data from a shared
				microarchitectural resource in line 4, for example, from the
				processor's L1 data cache. Since this vulnerability involves a race
				condition, the mov in line 4 

Many commodity processors share microarchitectural fill buffers
				between sibling hardware threads on simultaneous multithreaded (SMT)
				processors. Fill buffers can serve as temporary storage for data that
				passes to and from the processor's caches. Microarchitectural Fill
				Buffer Data Sampling (MFBDS) is a vulnerability that can allow a
				hardware thread to access its sibling's private data in a shared fill
				buffer. The access may be prohibited by the processor's ISA, but MFBDS
				can allow the access to occur during transient execution, in
				particular during a faulting operation or an operation that triggers a
				microcode assist. 

				 More information on MFBDS can be found in [REF-1405] and [REF-1409].

Real-world examples:
  - CVE-2017-5715: A fault may allow transient user-mode operations to
				access kernel data cached in the L1D, potentially exposing the data
				over a covert channel.
  - CVE-2018-3615: A fault may allow transient non-enclave operations to
				access SGX enclave data cached in the L1D, potentially exposing the
				data over a covert channel.
  - CVE-2019-1135: A TSX Asynchronous Abort may allow transient operations
				to access architecturally restricted data, potentially exposing the
				data over a covert channel.