Détail du CWE-1326

A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.

Modes d'introduction

Architecture and Design
Implementation : Such issues could be introduced during policy definition, hardware architecture, design, manufacturing, and/or provisioning. They can be identified later during testing or system configuration phases.

Plateformes applicables

Langue

Class: Not Language-Specific (Undetermined)

Systèmes d’exploitation

Class: Not OS-Specific (Undetermined)

Architectures

Class: Not Architecture-Specific (Undetermined)

Technologies

Name: Security Hardware (Undetermined)
Class: Not Technology-Specific (Undetermined)

Conséquences courantes

Mesures d’atténuation potentielles

Phases : Architecture and Design
When architecting the system, the RoT should be designated for storage in a memory that does not allow further programming/writes.
Phases : Implementation
During implementation and test, the RoT memory location should be demonstrated to not allow further programming/writes.

Méthodes de détection

Automated Dynamic Analysis

Automated testing can verify that RoT components are immutable.
Efficacité : High

Architecture or Design Review

Root of trust elements and memory should be part of architecture and design reviews.
Efficacité : High

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Modèles d'attaque associés

Références

REF-1152

TCG Roots of Trust Specification
Trusted Computing Group.
https://trustedcomputinggroup.org/wp-content/uploads/TCG_Roots_of_Trust_Specification_v0p20_PUBLIC_REVIEW.pdf

REF-1153

Root of Trust Definitions and Requirements
GlobalPlatform Security Task Force.
https://globalplatform.org/wp-content/uploads/2018/06/GP_RoT_Definitions_and_Requirements_v1.0.1_PublicRelease_CC.pdf

REF-1348

bootrom.sv
https://github.com/HACK-EVENT/hackatdac19/blob/619e9fb0ef32ee1e01ad76b8732a156572c65700/bootrom/bootrom.sv#L263C19-L263C19

REF-1349

bootrom.sv
https://github.com/HACK-EVENT/hackatdac19/blob/ba6abf58586b2bf4401e9f4d46e3f084c664ff88/bootrom/bootrom.sv#L259C9-L259C9

Soumission

Modifications