CWE-1256
Improper Restriction of Software Interfaces to Hardware Features
2020-02-24
00h00 +00:00
00h00 +00:00
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
名前: Improper Restriction of Software Interfaces to Hardware Features
The product provides software-controllable
device functionality for capabilities such as power and
clock management, but it does not properly limit
functionality that can lead to modification of
hardware memory or register bits, or the ability to
observe physical side channels.
一般情報
導入モード
Architecture and Design : An architect may initiate introduction of this weakness via exacting requirements for software accessible power/clock management requirementsImplementation : An implementer may introduce this weakness by assuming there are no consequences to unbounded power and clock management for secure components from untrusted ones.
適用可能なプラットフォーム
言語
クラス： Not Language-Specific (Undetermined)オペレーティングシステム
クラス： Not OS-Specific (Undetermined)アーキテクチャ
クラス： Not Architecture-Specific (Undetermined)テクノロジー
クラス： Not Technology-Specific (Undetermined)名前： Memory Hardware (Undetermined)
名前： Power Management Hardware (Undetermined)
名前： Clock/Counter Hardware (Undetermined)
一般的な結果
| スコープ | 影響 | 可能性 |
|---|---|---|
| Integrity | Modify Memory, Modify Application Data, Bypass Protection Mechanism |
観察された例
| 参考文献 | 説明 |
|---|---|
CVE-2019-11157 | Plundervolt: Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure via local access [REF-1081]. |
CVE-2020-8694 | PLATYPUS Attack: Insufficient access control in the Linux kernel driver for some Intel processors allows information disclosure. |
CVE-2020-8695 | Observable discrepancy in the RAPL interface for some Intel processors allows information disclosure. |
CVE-2020-12912 | AMD extension to a Linux service does not require privileged access to the RAPL interface, allowing side-channel attacks. |
CVE-2015-0565 | NaCl in 2015 allowed the CLFLUSH instruction, making Rowhammer attacks possible. |
潜在的な緩和策
Phases : Architecture and Design // Implementation検出方法
Manual Analysis
Perform a security evaluation of system-level architecture and design with software-aided physical attacks in scope.Automated Dynamic Analysis
有効性 : Moderate脆弱性マッピングノート
理由 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
関連する攻撃パターン
| CAPEC ID | 攻撃パターン名 |
|---|---|
| CAPEC-624 | Hardware Fault Injection
The adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient temperature extremes, and more. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. |
| CAPEC-625 | Mobile Device Fault Injection
Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised. |
参考文献
REF-1081
PlundervoltKit Murdock, David Oswald, Flavio D Garcia, Jo Van Bulck, Frank Piessens, Daniel Gruss.
https://plundervolt.com/
REF-1082
CLKSCREW: Exposing the Perils of Security-Oblivious Energy ManagementAdrian Tang, Simha Sethumadhavan, Salvatore Stolfo.
https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-tang.pdf
REF-1083
Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance ErrorsYoongu Kim, Ross Daly, Jeremie Kim, Ji Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, Onur Mutlu.
https://users.ece.cmu.edu/~yoonguk/papers/kim-isca14.pdf
REF-1225
Exploiting the DRAM rowhammer bug to gain kernel privilegesProject Zero.
https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
REF-1217
Security EngineeringRoss Anderson.
https://www.cl.cam.ac.uk/~rja14/musicfiles/manuscripts/SEv1.pdf
登録情報
| 名前 | 組織 | 日付 | リリース日 | Version |
|---|---|---|---|---|
| Nicole Fern | Cycuity (originally submitted as Tortuga Logic) | 4.1 |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CWE Content Team | MITRE | updated Demonstrative_Examples, Description, Maintenance_Notes, Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Functional_Areas, Maintenance_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Observed_Examples | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Description, Detection_Factors, Maintenance_Notes, Modes_of_Introduction, Name, Observed_Examples, References, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Relationships |
