CWE-385 (隐蔽时间通道) — Vulnerability Class 26

CWE-385 represents a timing-based information leakage weakness where sensitive data is transmitted indirectly by manipulating system behavior over time. Attackers typically exploit this by monitoring the duration of specific operations, such as cryptographic comparisons or database queries, to infer protected information like secret keys or user credentials. Since the timing variations correlate with internal state differences, an external observer can reconstruct private data without direct access to the memory or network traffic. Developers mitigate this risk by implementing constant-time algorithms that ensure execution time remains independent of secret inputs. Additionally, introducing random delays or padding operations can obscure timing patterns, making it significantly harder for adversaries to correlate observed delays with specific internal processes or data values.