CVE-2017-5928 in High Resolution Time API
Summary
by MITRE
The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "Time to Tick" approach even with the https://bugzilla.mozilla.org/show_bug.cgi?id=1167489#c9 protection mechanism in place, which makes it easier for remote attackers to conduct AnC attacks via crafted JavaScript code.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2020
The W3C High Resolution Time API represents a critical browser security vulnerability identified as CVE-2017-5928 that fundamentally undermines the integrity of timing-based security mechanisms across multiple web browsers. This vulnerability specifically targets the performance.now() JavaScript function which provides sub-millisecond precision timing information for web applications. The flaw exploits the inherent design of how browsers measure execution time and memory access patterns, creating a potential pathway for attackers to bypass security protections that rely on timing measurements. The vulnerability exists because the API implementation fails to properly account for memory-reference timing variations that can be measured through a technique known as "Time to Tick" attacks, which can be executed even when browsers implement mitigations such as those referenced in Mozilla Bugzilla report 1167489.
The technical exploitation of this vulnerability stems from the fact that modern processors and memory systems exhibit timing variations when accessing different memory locations, creating measurable differences that can be quantified through high-resolution timing functions. Attackers can craft malicious JavaScript code that leverages these timing variations to infer information about memory layouts, cache states, and other system characteristics that should remain hidden from web applications. This creates a sophisticated side-channel attack vector where the performance.now() function becomes a tool for extracting sensitive data rather than simply measuring execution time. The vulnerability's impact is particularly severe because it affects the core browser functionality that many security mechanisms depend upon, making it difficult to distinguish between legitimate timing measurements and malicious timing attacks.
Operationally, this vulnerability enables remote attackers to conduct Advanced Cache Attacks (AnC) that can compromise the security of web applications and user data. The attack methodology involves measuring the time differences between memory access patterns to determine cache states and potentially extract cryptographic keys, passwords, or other sensitive information. Security researchers have documented how this vulnerability can be used to bypass protections in web browsers, operating systems, and cryptographic libraries that rely on timing-based security models. The practical implications extend beyond simple information disclosure, as attackers can use these timing measurements to perform more sophisticated attacks such as cache timing attacks on encryption algorithms, potentially leading to complete cryptographic compromise. This vulnerability represents a fundamental weakness in browser security architecture that affects the trust model of web applications.
Mitigation strategies for CVE-2017-5928 require a multi-layered approach that addresses both the immediate implementation flaws and the broader security implications. Browser vendors should implement additional protections against timing-based side-channel attacks by introducing randomized timing measurements or reducing the precision of timing functions in contexts where security is paramount. The mitigation process involves updating browser implementations to prevent the exploitation of memory-reference timing variations while maintaining legitimate performance measurement capabilities. Organizations should also consider implementing Content Security Policy directives that restrict access to high-resolution timing functions in sensitive contexts, and security teams should monitor for potential exploitation attempts through anomalous timing measurement patterns. This vulnerability aligns with CWE-203, which addresses exposure of sensitive information through side channels, and represents a significant concern in the ATT&CK framework under the technique of "Timing Attack" where adversaries use timing information to infer system states and extract sensitive data.