CWE

CWE-1319 – Improper Protection against Electromagnetic Fault Injection (EM-FI)

Read Time:21 Second

Description

The device is susceptible to electromagnetic fault injection attacks, causing device internal information to be compromised or security mechanisms to be bypassed.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-693

 

Consequences

Confidentiality, Integrity, Access Control, Availability: Modify Memory, Read Memory, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Execute Unauthorized Code or Commands

 

Potential Mitigations

Phase: Architecture and Design, Implementation

Description: 

CVE References

CWE

CWE-1318 – Missing Support for Security Features in On-chip Fabrics or Buses

Read Time:35 Second

Description

On-chip fabrics or buses either do not support or are not configured to support privilege separation or other security features, such as access control.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-693

 

Consequences

Confidentiality, Integrity, Access Control, Availability: DoS: Crash, Exit, or Restart, Read Memory, Modify Memory

 

Potential Mitigations

Phase: Architecture and Design

Description: 

If fabric does not support security features, implement security checks in a bridge or any component that is between the master and the fabric. Alternatively, connect all fabric slaves that do not have any security assets under one such fabric and connect peripherals with security assets to a different fabric that supports security features.

CVE References

CWE

CWE-1317 – Missing Security Checks in Fabric Bridge

Read Time:47 Second

Description

A bridge that is connected to a fabric without security features forwards transactions to the slave without checking the privilege level of the master. Similarly, it does not check the hardware identity of the transaction received from the slave interface of the bridge.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-284

 

Consequences

Confidentiality, Integrity, Access Control, Availability: DoS: Crash, Exit, or Restart, Bypass Protection Mechanism, Read Memory, Modify Memory

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Design includes provisions for access-control checks in the bridge for both upstream and downstream transactions.

Phase: Implementation

Description: 

Implement access-control checks in the bridge for both upstream and downstream transactions.

CVE References

  • CVE-2019-6260
    • Baseboard Management Controller (BMC) device implements Advanced High-performance Bus (AHB) bridges that do not require authentication for arbitrary read and write access to the BMC’s physical address space from the host, and possibly the network [REF-1138].
CWE

CWE-1316 – Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges

Read Time:54 Second

Description

The address map of the on-chip fabric has protected and unprotected regions overlapping, allowing an attacker to bypass access control to the overlapping portion of the protected region.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-284

 

Consequences

Confidentiality, Integrity, Access Control, Authorization: Bypass Protection Mechanism, Read Memory, Modify Memory

 

Potential Mitigations

Phase: Architecture and Design

Description: 

When architecting the address map of the chip, ensure that protected and unprotected ranges are isolated and do not overlap. When designing, ensure that ranges hardcoded in Register-Transfer Level (RTL) do not overlap.

Phase: Implementation

Description: 

Ranges configured by firmware should not overlap. If overlaps are mandatory because of constraints such as a limited number of registers, then ensure that no assets are present in the overlapped portion.

Phase: Testing

Description: 

Validate mitigation actions with robust testing.

CVE References

  • CVE-2009-4419
    • Attacker can modify MCHBAR register to overlap with an attacker-controlled region, which modification prevents the SENTER instruction from properly applying VT-d protection while a Measured Launch Environment is being launched.
CWE

CWE-1315 – Improper Setting of Bus Controlling Capability in Fabric End-point

Read Time:1 Minute, 5 Second

Description

The bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-284

 

Consequences

Access Control: Modify Memory, Read Memory, Bypass Protection Mechanism

 

Potential Mitigations

Phase: Architecture and Design

Description: 

For responder devices, the register bit in the fabric end-point that enables the bus controlling capability must be set to 0 by default. This bit should not be set during secure-boot flows. Also, writes to this register must be access-protected to prevent malicious modifications to obtain bus-controlling capability.

Phase: Implementation

Description: 

For responder devices, the register bit in the fabric end-point that enables the bus controlling capability must be set to 0 by default. This bit should not be set during secure-boot flows. Also, writes to this register must be access-protected to prevent malicious modifications to obtain bus-controlling capability.

Phase: System Configuration

Description: 

For responder devices, the register bit in the fabric end-point that enables the bus controlling capability must be set to 0 by default. This bit should not be set during secure-boot flows. Also, writes to this register must be access-protected to prevent malicious modifications to obtain bus-controlling capability.

CVE References

CWE

CWE-1314 – Missing Write Protection for Parametric Data Values

Read Time:50 Second

Description

The device does not write-protect the parametric data values for sensors that scale the sensor value, allowing untrusted software to manipulate the apparent result and potentially damage hardware or cause operational failure.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-862
CWE-1299

 

Consequences

Availability: Quality Degradation, DoS: Resource Consumption (Other)

Sensor value manipulation, particularly thermal or power, may allow physical damage to occur or disabling of the device by a false fault shutdown causing a Denial-Of-Service.

 

Potential Mitigations

Phase: Architecture and Design

Effectiveness: High

Description: 

Access controls for sensor blocks should ensure that only trusted software is allowed to change threshold limits and sensor parametric data.

CVE References

  • CVE-2017-8252
    • Kernel can inject faults in computations during the execution of TrustZone leading to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice and Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking.
CWE

CWE-1313 – Hardware Allows Activation of Test or Debug Logic at Runtime

Read Time:1 Minute, 42 Second

Description

During runtime, the hardware allows for test or debug logic (feature) to be activated, which allows for changing the state of the hardware. This feature can alter the intended behavior of the system and allow for alteration and leakage of sensitive data by an adversary.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-284

 

Consequences

Confidentiality, Integrity, Availability: Modify Memory, Read Memory, DoS: Crash, Exit, or Restart, DoS: Instability, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other), Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Alter Execution Logic, Quality Degradation, Unexpected State, Reduce Performance, Reduce Reliability

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Insert restrictions on when the hardware’s test or debug features can be activated. For example, during normal operating modes, the hardware’s privileged modes that allow access to such features cannot be activated. Configuring the hardware to only enter a test or debug mode within a window of opportunity such as during boot or configuration stage. The result is disablement of such test/debug features and associated modes during normal runtime operations.

Phase: Implementation

Description: 

Insert restrictions on when the hardware’s test or debug features can be activated. For example, during normal operating modes, the hardware’s privileged modes that allow access to such features cannot be activated. Configuring the hardware to only enter a test or debug mode within a window of opportunity such as during boot or configuration stage. The result is disablement of such test/debug features and associated modes during normal runtime operations.

Phase: Integration

Description: 

Insert restrictions on when the hardware’s test or debug features can be activated. For example, during normal operating modes, the hardware’s privileged modes that allow access to such features cannot be activated. Configuring the hardware to only enter a test or debug mode within a window of opportunity such as during boot or configuration stage. The result is disablement of such test/debug features and associated modes during normal runtime operations.

CVE References

CWE

CWE-1312 – Missing Protection for Mirrored Regions in On-Chip Fabric Firewall

Read Time:30 Second

Description

The firewall in an on-chip fabric protects the main addressed region, but it does not protect any mirrored memory or memory-mapped-IO (MMIO) regions.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-284
CWE-1251

 

Consequences

Confidentiality, Integrity, Access Control: Modify Memory, Read Memory, Bypass Protection Mechanism

 

Potential Mitigations

Phase: Architecture and Design

Description: 

The fabric firewall should apply the same protections as the original region to the mirrored regions.

Phase: Implementation

Description: 

The fabric firewall should apply the same protections as the original region to the mirrored regions.

CVE References

CWE

CWE-1311 – Improper Translation of Security Attributes by Fabric Bridge

Read Time:34 Second

Description

The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-284

 

Consequences

Confidentiality, Integrity, Access Control: Modify Memory, Read Memory, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Execute Unauthorized Code or Commands

 

Potential Mitigations

Phase: Architecture and Design

Description: 

The translation must map signals in such a way that untrusted agents cannot map to trusted agents or vice-versa.

Phase: Implementation

Description: 

Ensure that the translation maps signals in such a way that untrusted agents cannot map to trusted agents or vice-versa.

CVE References

CWE

CWE-1310 – Missing Ability to Patch ROM Code

Read Time:57 Second

Description

Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-1329

 

Consequences

Other: Varies by Context, Reduce Maintainability

When the system is unable to be patched, it can be left in a vulnerable state.

 

Potential Mitigations

Phase: Architecture and Design, Implementation

Effectiveness: Moderate

Description: 

Secure patch support to allow ROM code to be patched on the next boot.

Some parts of the hardware initialization or signature verification done to authenticate patches will always be “not patchable.”

Phase: Architecture and Design, Implementation

Effectiveness: Moderate

Description: 

Support patches that can be programmed in-field or during manufacturing through hardware fuses. This feature can be used for limited patching of devices after shipping, or for the next batch of silicon devices manufactured, without changing the full device ROM.

Patches that use hardware fuses will have limitations in terms of size and the number of patches that can be supported. Note that some parts of the hardware initialization or signature verification done to authenticate patches will always be “not patchable.”

CVE References

News, Advisories and much more

Exit mobile version