CWE-514: Covert Channel

Description

A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.

Typically the system has not given authorization for the transmission and has no knowledge of its occurrence.

Potential Impact

Confidentiality, Access Control

Read Application Data, Bypass Protection Mechanism

Demonstrative Examples

In this example, the attacker observes how long an authentication takes when the user types in the correct password.

When the attacker tries their own values, they can first try strings of various length. When they find a string of the right length, the computation will take a bit longer, because the for loop will run at least once. Additionally, with this code, the attacker can possibly learn one character of the password at a time, because when they guess the first character right, the computation will take longer than a wrong guesses. Such an attack can break even the most sophisticated password with a few hundred guesses.

Bad

def validate_password(actual_pw, typed_pw):
		 
                   if len(actual_pw) <> len(typed_pw):
		   return 0
                   for i in len(actual_pw):
		   if actual_pw[i] <> typed_pw[i]:
		   return 0
                   
                   return 1

Note that in this example, the actual password must be handled in constant time as far as the attacker is concerned, even if the actual password is of an unusual length. This is one reason why it is good to use an algorithm that, among other things, stores a seeded cryptographic one-way hash of the password, then compare the hashes, which will always be of the same length.

Detection Methods

Architecture or Design Review SOAR Partial — According to SOAR [REF-1479], the following detection techniques may be useful:

Taxonomy Mappings

Landwehr: — Covert Channel

Frequently Asked Questions

What is CWE-514?

CWE-514 (Covert Channel) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Class-level weakness. A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.

How can CWE-514 be exploited?

Attackers can exploit CWE-514 (Covert Channel) to read application data, bypass protection mechanism. This weakness is typically introduced during the Implementation, Operation phase of software development.

How do I prevent CWE-514?

Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.

What is the severity of CWE-514?

CWE-514 is classified as a Class-level weakness (High abstraction). Its actual severity depends on the specific context and how the weakness manifests in your application.