Détail du CWE-1429

The product has a hardware interface that silently discards operations in situations for which feedback would be security-relevant, such as the timely detection of failures or attacks.

Modes d'introduction

Architecture and Design
Implementation
Requirements

Plateformes applicables

Langue

Name: C (Undetermined)
Name: C++ (Undetermined)
Name: Verilog (Undetermined)
Class: Hardware Description Language (Undetermined)
Class: Not Language-Specific (Undetermined)

Architectures

Name: ARM (Undetermined)
Name: x86 (Undetermined)
Class: Embedded (Undetermined)

Technologies

Name: Security Hardware (Undetermined)
Name: Processor Hardware (Undetermined)
Name: Microcontroller Hardware (Undetermined)
Class: System on Chip (Undetermined)

Conséquences courantes

Exemples observés

Mesures d’atténuation potentielles

Phases : Architecture and Design
Phases : Implementation

Méthodes de détection

Automated Static Analysis - Source Code

Efficacité : High

Manual Static Analysis - Source Code

Efficacité : Moderate

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Références

REF-1468

OpenTitan issue: [rv_core_ibex] Bus errors on integrity check failure
GregAC.
https://github.com/lowRISC/opentitan/issues/11336

Soumission

Modifications