CWE-208: Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
How it's found
Observable Timing Discrepancy is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
In security-relevant contexts, even small variations in timing can be exploited by attackers to indirectly infer certain details about the product's internal operations. For example, in some cryptographic algorithms, attackers can use timing differences to infer certain properties about a private key, making the key easier to guess. Timing discrepancies effectively form a timing side channel.
Vulnerable vs. safe
assign check_pass[i] = 1;continue;
assign check_pass[i] = 0;break;if (entered_pass[(i*8 - 1) : i] eq golden_pass([i*8 - 1) : i])elseendassign check_pass[3:0] = 4'b0;for (i = 0; i < 4; i++) beginassign grant_access = (check_pass == 4'b1111) ? 1'b1: 1'b0;always_comb @ (posedge clk)beginendassign check_pass[i] = 1;continue;
assign check_pass[i] = 0;continue;if (entered_pass[(i*8 - 1) : i] eq golden_pass([i*8 -1) : i])elseendassign check_pass[3:0] = 4'b0;for (i = 0; i < 4; i++) beginassign grant_access = (check_pass == 4'b1111) ? 1'b1: 1'b0;always_comb @ (posedge clk)beginendConsequences
- Read Application Data, Bypass Protection Mechanism
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-208?
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
How do you find Observable Timing Discrepancy?
Observable Timing Discrepancy is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-208?
Read Application Data, Bypass Protection Mechanism
Does TurboPentest test for Observable Timing Discrepancy?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest