CWE-1234
Hardware Internal or Debug Modes Allow Override of Locks
2020-02-24
00h00 +00:00
00h00 +00:00
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
名前: Hardware Internal or Debug Modes Allow Override of Locks
System configuration protection may be bypassed during debug mode.
一般情報
背景の詳細
導入モード
Architecture and Design : Debug features supported by hardware or internal modes/system states might be supported in the hardware design.Implementation
適用可能なプラットフォーム
言語
クラス： Not Language-Specific (Undetermined)オペレーティングシステム
クラス： Not OS-Specific (Undetermined)アーキテクチャ
クラス： Not Architecture-Specific (Undetermined)テクノロジー
クラス： Not Technology-Specific (Undetermined)一般的な結果
| スコープ | 影響 | 可能性 |
|---|---|---|
| Access Control | Bypass Protection Mechanism 注記：Bypass of the lock bit protection may allow access and modification of system configuration information, even when the lock bit is set. | High |
潜在的な緩和策
Phases : Architecture and Design // Implementation // Testing脆弱性マッピングノート
理由 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
関連する攻撃パターン
| CAPEC ID | 攻撃パターン名 |
|---|---|
| CAPEC-176 | Configuration/Environment Manipulation
An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack. |
参考文献
REF-1375
reglk_wrapper.svhttps://github.com/HACK-EVENT/hackatdac21/blob/cde1d9d6888bffab21d4b405ccef61b19c58dd3c/piton/design/chip/tile/ariane/src/reglk/reglk_wrapper.sv#L80C1-L80C48
REF-1376
Fix for reglk_wrapper.svhttps://github.com/HACK-EVENT/hackatdac21/blob/20238068b385d7ab704cabfb95ff95dd6e56e1c2/piton/design/chip/tile/ariane/src/reglk/reglk_wrapper.sv#L80
登録情報
| 名前 | 組織 | 日付 | リリース日 | Version |
|---|---|---|---|---|
| Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi | Intel Corporation | 4.0 |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CWE Content Team | MITRE | updated Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, Potential_Mitigations, Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, References | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Background_Details, Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction |
