CWE-1294
Insecure Security Identifier Mechanism
Incomplete
2020-08-20
00h00 +00:00
00h00 +00:00
2025-12-11
00h00 +00:00
00h00 +00:00
Notifications for a CWE
Stay informed of any changes for a specific CWE.
Name: Insecure Security Identifier Mechanism
The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented.
General Informations
Modes Of Introduction
Architecture and Design : Such issues could be introduced during hardware architecture and design, then identified later during Testing or System Configuration phases.Implementation : Such issues could be introduced during hardware implementation, then identified later during Testing or System Configuration phases.
Applicable Platforms
Language
Class: Not Language-Specific (Undetermined)Operating Systems
Class: Not OS-Specific (Undetermined)Architectures
Class: Not Architecture-Specific (Undetermined)Technologies
Name: Bus/Interface Hardware (Undetermined)Class: Not Technology-Specific (Undetermined)
Common Consequences
| Scope | Impact | Likelihood |
|---|---|---|
| Confidentiality Integrity Availability Access Control | Modify Memory, Read Memory, DoS: Resource Consumption (Other), Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Quality Degradation | High |
Potential Mitigations
Phases : Architecture and DesignSecurity Identifier Decoders must be reviewed for design inconsistency and common weaknesses.
Phases : Implementation
Access and programming flows must be tested in pre-silicon and post-silicon testing.
Vulnerability Mapping Notes
Justification : This CWE entry is a Class and might have Base-level children that would be more appropriateComment : Examine children of this entry to see if there is a better fit
Related Attack Patterns
| CAPEC-ID | Attack Pattern Name |
|---|---|
| CAPEC-121 | Exploit Non-Production Interfaces
|
| CAPEC-681 | Exploitation of Improperly Controlled Hardware Security Identifiers
|
Notes
This entry is still under development and will continue to see updates and content improvements.Submission
| Name | Organization | Date | Date release | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 4.2 |
Modifications
| Name | Organization | Date | Comment |
|---|---|---|---|
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities |
