CWE-208: Observable Timing Discrepancy

Extended Description

In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations. For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess. Timing discrepancies effectively form a timing side channel.

Code Examples & CVEs

Demonstrative Examples

Consider an example hardware module that checks a user-provided password to grant access to a user. The user-provided password is compared against a golden value in a byte-by-byte manner.

Since the code breaks on an incorrect entry of password, an attacker can guess the correct password for that byte-check iteration with few repeat attempts.

BadVerilog

always_comb @ (posedge clk)                                          begin 		                           assign check_pass[3:0] = 4'b0;                       for (i = 0; i < 4; i++) begin 		                           	if (entered_pass[(i*8 - 1) : i] eq golden_pass([i*8 - 1) : i]) 			 			  assign check_pass[i] = 1;                     	  continue; 			                     	else 			                     	  assign check_pass[i] = 0;                     	  break; 			                     	end 		                             assign grant_access = (check_pass == 4'b1111) ? 1'b1: 1'b0; 		                         end

Consider an example hardware module that checks a user-provided password to grant access to a user. The user-provided password is compared against a golden value in a byte-by-byte manner.

Since the code breaks on an incorrect entry of password, an attacker can guess the correct password for that byte-check iteration with few repeat attempts.

GoodVerilog

always_comb @ (posedge clk) 		  begin 		                       assign check_pass[3:0] = 4'b0;                	    for (i = 0; i < 4; i++) begin 		                    	      if (entered_pass[(i*8 - 1) : i] eq golden_pass([i*8 -1) : i]) 		                      		assign check_pass[i] = 1;                		continue; 		                      	      else 		                      		assign check_pass[i] = 0;                		continue; 		                      	      end 		                    	    assign grant_access = (check_pass == 4'b1111) ? 1'b1: 1'b0; 		   		  end

In this example, the attacker observes how long an authentication takes when the user types in the correct password.

When the attacker tries their own values, they can first try strings of various length. When they find a string of the right length, the computation will take a bit longer, because the for loop will run at least once. Additionally, with this code, the attacker can possibly learn one character of the password at a time, because when they guess the first character right, the computation will take longer than a wrong guesses. Such an attack can break even the most sophisticated password with a few hundred guesses.

BadPython

def validate_password(actual_pw, typed_pw): 		                     if len(actual_pw) <> len(typed_pw): 		   return 0                    for i in len(actual_pw): 		   if actual_pw[i] <> typed_pw[i]: 		   return 0                                        return 1

Observed CVE Examples (9)

CVE-2019-10071

Java-oriented framework compares HMAC signatures using String.equals() instead of a constant-time algorithm, causing timing discrepancies

View Details

CVE-2019-10482

Smartphone OS uses comparison functions that are not in constant time, allowing side channels

View Details

CVE-2014-0984

Password-checking function in router terminates validation of a password entry when it encounters the first incorrect character, which allows remote attackers to obtain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.

View Details

CVE-2003-0078

SSL implementation does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."

View Details

CVE-2000-1117

Virtual machine allows malicious web site operators to determine the existence of files on the client by measuring delays in the execution of the getSystemResource method.

View Details

CVE-2003-0637

Product uses a shorter timeout for a non-existent user than a valid user, which makes it easier for remote attackers to guess usernames and conduct brute force password guessing.

View Details

CVE-2003-0190

Product immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack.

View Details

CVE-2004-1602

FTP server responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response.

View Details

CVE-2005-0918

Browser allows remote attackers to determine the existence of arbitrary files by setting the src property to the target filename and using Javascript to determine if the web page immediately stops loading, which indicates whether the file exists or not.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-208 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-208, Observable Timing Discrepancy, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Make elimination of CWE-208 a product outcome

Apply CISA's Secure by Design principle of taking ownership of customer security outcomes to CWE-208, Observable Timing Discrepancy. Put the weakness in the product threat model and security roadmap, fund class-level design and platform changes, prefer safe defaults and reusable guardrails, and publish measurable progress. Do not transfer the primary burden to customer configuration when the manufacturer can remove or contain the root cause in the product.

Shifting the Balance of Cybersecurity Risk: Secure by Design Software — Cybersecurity and Infrastructure Security Agency

Connect Observable Timing Discrepancy to documented attack evidence

Recorded impacts include Read Application Data, and Bypass Protection Mechanism; the entry maps to CAPEC-462, CAPEC-541, and CAPEC-580; observed examples include CVE-2019-10071, CVE-2019-10482, and CVE-2014-0984. Use these source-defined anchors to turn CWE-208 into implementation, review, and verification checks for the affected component.

CWE-208: Observable Timing Discrepancy — MITRE CWE

Apply precise root-cause mapping to CWE-208

Apply MITRE's full root-cause mapping guidance when using CWE-208, Observable Timing Discrepancy. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-208 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-208, Observable Timing Discrepancy. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-208: Observable Timing Discrepancy?+

CWE-208: Observable Timing Discrepancy is a Common Weakness Enumeration (CWE) entry maintained by MITRE. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations. For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess. Timing discrepancies effectively form a timing side channel.

What are the security consequences of Observable Timing Discrepancy?+

If exploited, CWE-208 (Observable Timing Discrepancy) it can compromise Confidentiality and Access Control, leading to outcomes such as Read Application Data and Bypass Protection Mechanism.

Which programming languages are affected by Observable Timing Discrepancy?+

CWE-208 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Observable Timing Discrepancy?+

MITRE documents real CVEs mapped to CWE-208, including CVE-2019-10071, CVE-2019-10482, CVE-2014-0984, CVE-2003-0078 and CVE-2000-1117. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-208 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-208: Observable Timing Discrepancy

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (9)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Verify controls for CWE-208 with SSDF evidence

Make elimination of CWE-208 a product outcome

Connect Observable Timing Discrepancy to documented attack evidence

Apply precise root-cause mapping to CWE-208

Validate CWE-208 with root-cause mapping checks

Frequently Asked Questions

Learn More