cve.bz

CAPEC-663

Exploitation of Transient Instruction Execution

Very High severityLow likelihoodStandard pattern

An adversary exploits a hardware design flaw in a CPU implementation of transient instruction execution to expose sensitive data and bypass/subvert access control over restricted resources. Typically, the adversary conducts a covert channel attack to target non-discarded microarchitectural changes caused by transient executions such as speculative execution, branch prediction, instruction pipelining, and/or out-of-order execution. The transient execution results in a series of instructions (gadgets) which construct covert channel and access/transfer the secret data.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-663: Exploitation of Transient Instruction Execution: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/663.html and https://cve.bz/cve/capec/663?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Survey target application and relevant OS shared code libraries] Adversary identifies vulnerable transient instruction sets and the code/function calls to trigger them as well as instruction sets or code fragments (gadgets) to perform attack.

      1 technique
      • Utilize Disassembler and Debugger tools to examine and trace instruction set execution of source code and shared code libraries on a system.

    2. [Explore cache and identify impacts] Utilize tools to understand the impact of transient instruction execution upon address spaces and CPU operations.

      1 technique
      • Run OS or application specific tools that examine the contents of cache.

  2. Experiment

    They probe what they found.

    1. [Cause conditions for identified transient instruction set execution] Adversary ensures that specific code/instructions of the target process are executed by CPU, so desired transient instructions are executed.

    2. [Cause specific secret data to be cached from restricted address space] Executed instruction sets (gadgets) in target address space, initially executed via adversary-chosen transient instructions sets, establish covert channel and transfer secret data across this channel to cache.

      2 techniques
      • Prediction-based - adversary trains CPU to incorrectly predict/speculate conditions for instruction execution to be true, hence executing adversary-chosen transient instructions. These prediction-based methods include: Pattern History Table (PHT)/Input Validation Bypass, Branch Target Buffer (BTB)/Branch Target Injection, Return Stack Buffer (RSB)/Return Address Injection, and Store To Load (STL)/Speculative Store Bypass.
      • Exception/Fault-based - adversary has CPU execute transient instructions that raise an exception allowing inaccessible memory space to be accessed via out-of-order execution. These exception/fault-based methods include: Supervisor-only Bypass, Virtual Translation Bypass, System Register Bypass, FPU Register Bypass, Read-only Bypass, Protection Key Bypass, and Bounds Check Bypass.

  3. Exploit

    They carry out the attack.

    1. [Perform covert channel attack to obtain/access secret data] Adversary process code removes instructions/data from shared cache set, waits for target process to reinsert them back into cache, to identify location of secret data via a timing method. Adversary continuously repeat this process to identify and access entirety of targeted secret data.

      3 techniques
      • Flush+Reload - adversary frequently flushes targeted memory cache line using a dedicated machine flush instruction, and uses another process to measure time taken for CPU to load victim secret data.
      • Evict+Time - adversary causes victim to load target set into cache and measures time for victim process to load this data, setting a baseline. Adversary evicts a specified cache line and causes victim process to execute again, and measures any change in execution time, to determine if cache line was accessed.
      • Prime+Probe - adversary primes cache by filling cache line(s) or set(s) with data, after some time victim process evicts this adversary data to replace it with secret data. The adversary then probes/accesses all the previously accessed cache lines detecting cache misses, which determine that their attacker data has been evicted and replaced with secret data from victim process.

Prerequisites

  • The adversary needs at least user execution access to a system and a maliciously crafted program/application/process with unprivileged code to misuse transient instruction set execution of the CPU.

Skills required

  • High skill

    Detailed knowledge on how various CPU architectures and microcode perform transient execution for various low-level assembly language code instructions/operations.

  • High skill

    Detailed knowledge on compiled binaries and operating system shared libraries of instruction sequences, and layout of application and OS/Kernel address spaces for data leakage.

Resources required

  • C2C mechanism or direct access to victim system, capable of dropping malicious program and collecting covert channel attack data.

  • Malicious program capable of triggering execution of transient instructions or vulnerable instruction sequences of victim program and performing a covert channel attack to gather data from victim process memory space. Ultimately, the speed with which an attacker discovers a secret is directly proportional to the computational resources of the victim machine.

Signs of an attack

  • File Signatures for Malicious Software capable of abusing Transient Instruction Set Execution

Consequences

What a successful attack can lead to
ImpactAffectsNote
Read DataConfidentiality
Bypass Protection MechanismAccess Control
Execute Unauthorized CommandsAuthorization

Mitigations

  • Implementation: DAWG (Dynamically Allocated Way Guard) - processor cache properly divided between different programs/processes that don't share resources

  • Implementation: KPTI (Kernel Page-Table Isolation) to completely separate user-space and kernel space page tables

  • Configuration: Architectural Design of Microcode to limit abuse of speculative execution and out-of-order execution

  • Configuration: Disable SharedArrayBuffer for Web Browsers

  • Configuration: Disable Copy-on-Write between Cloud VMs

  • Configuration: Privilege Checks on Cache Flush Instructions

  • Implementation: Non-inclusive Cache Memories to prevent Flush+Reload Attacks

Weaknesses it exploits

  • CWE-1037 Processor Optimization Removal or Modification of Security-critical Code
  • CWE-1264 Hardware Logic with Insecure De-Synchronization between Control and Data Channels
  • CWE-1303 Non-Transparent Sharing of Microarchitectural Resources

Recent CVEs with these weaknesses

  1. 3.3CVE-2026-112558

    A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data.

  2. 5.6CVE-2026-59131

    No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.

  3. 5.6CVE-2026-59130

    No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally.

  4. 5.5CVE-2025-48810

    Processor optimization removal or modification of security-critical code in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.

  5. 5.5CVE-2025-48809

    Processor optimization removal or modification of security-critical code in Windows Kernel allows an authorized attacker to disclose information locally.

  6. 5.5CVE-2025-26636

    Processor optimization removal or modification of security-critical code in Windows Kernel allows an authorized attacker to disclose information locally.

  7. 5.5CVE-2024-45335

    Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted virus to allow itself to bypass and evade a virus scan detection.

  8. 5.6CVE-2024-37985

    Windows Kernel Information Disclosure Vulnerability

The newest records naming one of them. Each weakness's page lists them all.

Part of
Can lead to
Related to
  • CAPEC-212 Functionality Misuse
  • CAPEC-124 Shared Resource Manipulation
  • CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels
More specific patterns

Examples

A web browser with user-privileges executes JavaScript code imbedded within a malicious website. The system d…

A web browser with user-privileges executes JavaScript code imbedded within a malicious website. The system does not disable shared buffers for the web browser and there is no restriction or check upon user-process execution of flush or evict instructions. The Javascript code executes vulnerable transient instructions upon system to cause microarchitectural changes that establish covert channel and transfer sensitive/secret data into shared cache from address space of either kernel, web browser or another executing process on the system.

MITRE's words, unchanged: CAPEC-663 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.