Nama: Hardware Logic Contains Race Conditions

A race condition in the hardware logic results in undermining security guarantees of the system.

Informasi Umum

Mode Pengenalan

Architecture and Design
Implementation

Platform yang Berlaku

Bahasa

Nama: Verilog (Undetermined)
Nama: VHDL (Undetermined)

Teknologi

Kelas: System on Chip (Undetermined)

Konsekuensi Umum

Cakupan	Dampak	Kemungkinan
Access Control	Bypass Protection Mechanism, Gain Privileges or Assume Identity, Alter Execution Logic Catatan: If timing errors occur in access control logic or finite state machines that are implemented in security sensitive flows, an attacker might exploit them to circumvent existing protections.

Mitigasi yang Memungkinkan

Phases : Architecture and Design
Adopting design practices that encourage designers to recognize and eliminate race conditions, such as Karnaugh maps, could result in the decrease in occurrences of race conditions.
Phases : Implementation
Logic redundancy can be implemented along security critical paths to prevent race conditions. To avoid metastability, it is a good practice in general to default to a secure state in which access is not given to untrusted agents.

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Pola Serangan Terkait

CAPEC ID	Nama Pola Serangan
CAPEC-26	Leveraging Race Conditions The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.

Referensi

REF-1115

FPGA designs with Verilog (section 7.4 Glitches)
Meher Krishna Patel.
https://verilogguide.readthedocs.io/en/latest/verilog/fsm.html

REF-1116

Non-Blocking Assignments in Verilog Synthesis, Coding Styles that Kill!
Clifford E. Cummings.
http://www.sunburst-design.com/papers/CummingsSNUG2000SJ_NBA.pdf

REF-1394

dma.sv
https://github.com/HACK-EVENT/hackatdac21/blob/main/piton/design/chip/tile/ariane/src/dma/dma.sv

REF-1395

Fix for dma.sv
https://github.com/HACK-EVENT/hackatdac21/blob/cwe_1298_in_dma/piton/design/chip/tile/ariane/src/dma/dma.sv

Pengajuan

Nama	Organisasi	Tanggal	Tanggal rilis	Version
Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi	Intel Corporation	2020-02-10 +00:00	2020-08-20 +00:00	4.2

Modifikasi

Nama	Organisasi	Tanggal	Komentar
CWE Content Team	MITRE	2021-07-20 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2024-02-29 +00:00	updated Demonstrative_Examples, References
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Demonstrative_Examples, Description

Detail CWE-1298

CWE-1298