CWE-208 Observable Timing Discrepancy Analysis and Mitigation

Vulnerability Overview Vulnerability Name: CWE-208: Observable Timing Discrepancy Vulnerability Description: Two distinct operations in the product require different amounts of time to complete. This timing difference can be observed by an attacker and reveals security-related information regarding the product's state. In a security context, even minor timing discrepancies can be exploited by attackers to indirectly infer details about internal operations. For example, in certain cryptographic algorithms, attackers can leverage timing differences to infer attributes of a private key, making the key easier to crack. These timing differences effectively create a timing side channel. Impact Impact: Reading application data, bypassing protection mechanisms Scope: Confidentiality, Access Control Remediation 1. Hardware Module Example: - In a hardware module, a user-provided password is checked to grant access. The user-provided password is compared byte-by-byte against a golden standard password. - If the code interrupts when an incorrect password is entered, an attacker can guess the correct password through repeated attempts. - To mitigate this weakness, the entire string comparison should be completed atomically (in one go), or the attacker should receive no indication of whether the password is correct or incorrect, as the comparison must process all bits before the signal is set. 2. Software Example: - In software, an attacker observes the authentication time when the user inputs the correct password. - When the attacker tests their own values, they can first try strings of different lengths. When a string of the correct length is found, the computation takes longer because the loop runs at least once. Furthermore, with this code, an attacker can learn one character of the password at a time, as the computation takes longer when a character is correct. Such an attack can crack even complex passwords with only a few hundred guesses. - In this example, the actual password must be processed in constant time, regardless of whether the actual password is unusually long. Therefore, a good approach is to store the password as a cryptographic one-way hash and then compare the hashes, which always have the same length. POC Code Hardware Module Example Software Example Additional Information Related Views: - Research Concepts (View-1000) - Software Development (View-699) - Architectural Concepts (View-1008) Pattern Description: - Architecture and Design: This weakness refers to erroneous design related to architectural security tactics. Applicable Platforms: - Language: Language Independent - Technology: Technology Independent Demonstrative Examples: - Example 1: Hardware Module - Example 2: Software Example Selected Observational Examples: - CVE-2019-10072: Java framework compares HMAC signatures using instead of a constant-time algorithm, leading to timing discrepancies. - CVE-2019-10582: Smartphone OS uses non-constant-time comparison functions, enabling side-channel attacks. - CVE-2014-0984: Router password check function terminates verification upon encountering the first incorrect character, allowing remote attackers to obtain the password via brute-force attacks. - CVE-2003-0078: SSL implementation does not perform MAC calculation; if incorrect block cipher padding is used, it may lead to information leakage. - CVE-2000-1117: Virtual machine allows malicious website operators to determine the existence of files on the client by measuring latency. - CVE-2003-0637: The product returns a shorter timeout for non-existent users, making it easier for remote attackers to guess usernames and perform brute-force password guessing. - CVE-2003-0190: The product immediately sends an error message when the user does not exist, allowing remote attackers to determine valid usernames via timing attacks. - CVE-2004-1602: FTP server responds at different times depending on whether the given username exists, allowing remote attackers to identify valid usernames by timing server responses. - CVE-2005-0918: Browser allows remote attackers to determine the existence of arbitrary files by setting the attribute to the target filename and using JavaScript. Weakness Ordinality: - Primary: The weakness exists independently of other weaknesses. - Result: The weakness is usually associated with the existence of certain other weaknesses. Functional Areas: - Cryptography - Authentication Members: - SFP Secondary Cluster: State Disclosure - Comprehensive Categorization: Sensitive Information Exposure Vulnerability Mapping Notes: - Use: Allowed - Reason: Acceptable use - Justification: This CWE entry is at a level of abstracting that is preferred for mapping to the root cause of vulnerabilities. - Comment: Read the name and description carefully to ensure the mapping is appropriate. Do not try to "force" the mapping to a lower level. Remarks: - Relations: Primarily occurs in cryptographic applications and algorithms. - Maintenance: CWE 4.16 r

Goal Reached Thanks to every supporter — we hit 100%!

CWE-208 Observable Timing Discrepancy Analysis and Mitigation