Detail CWE-1290

CWE-1290

Incorrect Decoding of Security Identifiers
2020-08-20
00h00 +00:00
Incomplete
2026-10-28
00h00 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Incorrect Decoding of Security Identifiers

The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers, but it decodes an untrusted agent's security identifier into a trusted agent's security identifier.

Informasi Umum

Detail Latar Belakang

Mode Pengenalan

Implementation
Architecture and Design

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Sistem Operasi

Kelas: Not OS-Specific (Undetermined)

Arsitektur

Kelas: Not Architecture-Specific (Undetermined)

Teknologi

Nama: Bus/Interface Hardware (Undetermined)
Kelas: Not Technology-Specific (Undetermined)

Konsekuensi Umum

Cakupan Dampak Kemungkinan
Confidentiality
Integrity
Availability
Access Control		Modify Memory, Read Memory, DoS: Resource Consumption (Other), Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Quality Degradation

Catatan: If the decoding of an untrusted agent's identifier produces the security identifier of a trusted agent, then the untrusted agent can gain unauthorized access to the asset.		High

Mitigasi yang Memungkinkan

Phases : Architecture and Design
Security identifier decoders must be reviewed for design consistency and common weaknesses.
Phases : Implementation
Access and programming flows must be tested in pre-silicon and post-silicon testing in order to check for this weakness.

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna Intel Corporation 2020-04-29 +00:00 2020-08-20 +00:00 4.2

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2021-07-20 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2021-10-28 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2022-04-28 +00:00 updated Applicable_Platforms
CWE Content Team MITRE 2022-06-28 +00:00 updated Applicable_Platforms
CWE Content Team MITRE 2022-10-13 +00:00 updated Demonstrative_Examples, Related_Attack_Patterns
CWE Content Team MITRE 2023-01-31 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-12-11 +00:00 updated Weakness_Ordinalities
CWE Content Team MITRE 2026-10-28 +00:00 updated Background_Details, Common_Consequences, Description, Dimensions, Relationships
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.