Nama: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)

The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents.

Informasi Umum

Mode Pengenalan

Architecture and Design
Implementation

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Teknologi

Kelas: System on Chip (Undetermined)

Konsekuensi Umum

Cakupan	Dampak	Kemungkinan
Access Control	Bypass Protection Mechanism Catatan: If resources being used by a trusted user are shared with an untrusted user, the untrusted user may be able to modify the functionality of the shared resource of the trusted user.
Integrity	Quality Degradation Catatan: The functionality of the shared resource may be intentionally degraded.

Contoh yang Diamati

Referensi	Deskripsi
CVE-2020-8698	Processor has improper isolation of shared resources allowing for information disclosure.
CVE-2019-6260	Baseboard Management Controller (BMC) device implements Advanced High-performance Bus (AHB) bridges that do not require authentication for arbitrary read and write access to the BMC's physical address space from the host, and possibly the network [REF-1138].

Mitigasi yang Memungkinkan

Phases : Architecture and Design

Metode Deteksi

Automated Dynamic Analysis

Efektivitas : High

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Pola Serangan Terkait

CAPEC ID	Nama Pola Serangan
CAPEC-124	Shared Resource Manipulation An adversary exploits a resource shared between multiple applications, an application pool or hardware pin multiplexing to affect behavior. Resources may be shared between multiple applications or between multiple threads of a single application. Resource sharing is usually accomplished through mutual access to a single memory location or multiplexed hardware pins. If an adversary can manipulate this shared resource (usually by co-opting one of the applications or threads) the other applications or threads using the shared resource will often continue to trust the validity of the compromised shared resource and use it in their calculations. This can result in invalid trust assumptions, corruption of additional data through the normal operations of the other users of the shared resource, or even cause a crash or compromise of the sharing applications.

Referensi

REF-1036

Ghost in the PLC Designing an Undetectable Programmable Logic Controller Rootkit via Pin Control Attack
Ali Abbasi and Majid Hashemi.
https://www.blackhat.com/docs/eu-16/materials/eu-16-Abbasi-Ghost-In-The-PLC-Designing-An-Undetectable-Programmable-Logic-Controller-Rootkit-wp.pdf

REF-1138

CVE-2019-6260: Gaining control of BMC from the host processor
Stewart Smith.
https://www.flamingspork.com/blog/2019/01/23/cve-2019-6260:-gaining-control-of-bmc-from-the-host-processor/

Pengajuan

Nama	Organisasi	Tanggal	Tanggal rilis	Version
Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi	Intel Corporation	2019-10-15 +00:00	2020-02-24 +00:00	4.0

Modifikasi

Nama	Organisasi	Tanggal	Komentar
CWE Content Team	MITRE	2020-08-20 +00:00	updated Common_Consequences, Description, Name, Potential_Mitigations, Related_Attack_Patterns, Relationships
CWE Content Team	MITRE	2020-12-10 +00:00	updated Relationships
CWE Content Team	MITRE	2021-07-20 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2021-10-28 +00:00	updated Description, Observed_Examples, References, Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2022-10-13 +00:00	updated Detection_Factors
CWE Content Team	MITRE	2023-04-27 +00:00	updated Observed_Examples, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes, Relationships
CWE Content Team	MITRE	2025-04-03 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2025-09-09 +00:00	updated Relationships
CWE Content Team	MITRE	2026-10-28 +00:00	updated Dimensions

Detail CWE-1189

CWE-1189