CAPEC-681
Exploitation of Improperly Controlled Hardware Security Identifiers
Medio
Draft
2021-10-21
00h00 +00:00
00h00 +00:00
Alerta para un CAPEC
Manténgase informado sobre cualquier cambio en un CAPEC específico.
Informaciones CAPEC
Prerrequisitos
Awareness of the hardware being leveraged.Access to the hardware being leveraged.
Habilidades requeridas
Ability to execute actions within the SoC.Intricate knowledge of the identifiers being utilized.
Mitigaciones
Review generation of security identifiers for design inconsistencies and common weaknesses.Review security identifier decoders for design inconsistencies and common weaknesses.
Test security identifier definition, access, and programming flow in both pre-silicon and post-silicon environments.
Debilidades relacionadas
| Nombre de la debilidad | |
|---|---|
CWE-1259 |
Improper Restriction of Security Token Assignment The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected. |
CWE-1267 |
Policy Uses Obsolete Encoding The product uses an obsolete encoding mechanism to implement access controls. |
CWE-1270 |
Generation of Incorrect Security Tokens The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect. |
CWE-1294 |
Insecure Security Identifier Mechanism The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented. |
CWE-1302 |
Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. A transaction is sent without a security identifier. |
Referencias
REF-694
PCIe Device Measurement Requirementshttps://www.intel.com/content/dam/www/public/us/en/documents/reference-guides/pcie-device-security-enhancements.pdf
REF-695
BIOS Chronomancy: Fixing the Core Root of Trust for MeasurementJohn Butterworth, Cory Kallenberg, Xeno Kovah.
https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-Slides.pdf
Envío
| Nombre | Organización | Fecha | Fecha de lanzamiento |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
