Détail du CWE-1283

The register contents used for attestation or measurement reporting data to verify boot flow are modifiable by an adversary.

Modes d'introduction

Architecture and Design : Such issues can be introduced during hardware architecture or design and can be identified later during Testing or System Configuration phases.
Implementation : If the access-controls which protecting the reporting registers are misconfigured during implementation, this weakness can arise.

Plateformes applicables

Langue

Class: Not Language-Specific (Undetermined)

Systèmes d’exploitation

Class: Not OS-Specific (Undetermined)

Architectures

Class: Not Architecture-Specific (Undetermined)

Technologies

Class: Not Technology-Specific (Undetermined)

Conséquences courantes

Mesures d’atténuation potentielles

Phases : Architecture and Design

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Modèles d'attaque associés

Notes

This entry is still in development and will continue to see updates and content improvements.

Références

REF-1107

PCIe Device Measurement Requirements
Intel Corporation.
https://www.intel.com/content/dam/www/public/us/en/documents/reference-guides/pcie-device-security-enhancements.pdf

REF-1131

BIOS Chronomancy: Fixing the Core Root of Trust for Measurement
John Butterworth, Cory Kallenberg, Xeno Kovah.
https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-Slides.pdf

Soumission

Modifications