CWE-1254: Incorrect Comparison Logic Granularity

The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.

Comparison logic is used to compare a variety of objects including passwords, Message Authentication Codes (MACs), and responses to verification challenges. When comparison logic is implemented at a finer granularity (e.g., byte-by-byte comparison) and breaks in the case of a comparison failure, an attacker can exploit this implementation to identify when exactly the failure occurred. With multiple attempts, the attacker may be able to guesses the correct password/response to challenge and elevate their privileges.

Consequences

• Confidentiality, Authorization: Bypass Protection Mechanism

How to prevent it

• Implementation: The hardware designer should ensure that comparison logic is implemented so as to compare in one operation instead in smaller chunks.

Recent advisories

• GHSA-8fq3-c5w3-pj3q — CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
• GHSA-4vxv-4xq4-p84h — CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
• GHSA-xxvh-5hwj-42pp — OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation
• GHSA-3m6r-39p3-jq25 — Doorkeeper is vulnerable to replay attacks

All advisories for CWE-1254