CWE-1256
Improper Restriction of Software Interfaces to Hardware Features
2020-02-24
00h00 +00:00
00h00 +00:00
특정 CWE 알림
특정 CWE의 변경 사항에 대한 정보를 받아보세요.
이름: Improper Restriction of Software Interfaces to Hardware Features
The product provides software-controllable
device functionality for capabilities such as power and
clock management, but it does not properly limit
functionality that can lead to modification of
hardware memory or register bits, or the ability to
observe physical side channels.
일반 정보
취약점 도입 방식
Architecture and Design : An architect may initiate introduction of this weakness via exacting requirements for software accessible power/clock management requirementsImplementation : An implementer may introduce this weakness by assuming there are no consequences to unbounded power and clock management for secure components from untrusted ones.
적용 가능한 플랫폼
언어
클래스: Not Language-Specific (Undetermined)운영 체제
클래스: Not OS-Specific (Undetermined)아키텍처
클래스: Not Architecture-Specific (Undetermined)기술
클래스: Not Technology-Specific (Undetermined)이름: Memory Hardware (Undetermined)
이름: Power Management Hardware (Undetermined)
이름: Clock/Counter Hardware (Undetermined)
일반적인 결과
| 범위 | 영향 | 가능성 |
|---|---|---|
| Integrity | Modify Memory, Modify Application Data, Bypass Protection Mechanism |
관찰된 예시
| 참고 자료 | 설명 |
|---|---|
CVE-2019-11157 | Plundervolt: Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure via local access [REF-1081]. |
CVE-2020-8694 | PLATYPUS Attack: Insufficient access control in the Linux kernel driver for some Intel processors allows information disclosure. |
CVE-2020-8695 | Observable discrepancy in the RAPL interface for some Intel processors allows information disclosure. |
CVE-2020-12912 | AMD extension to a Linux service does not require privileged access to the RAPL interface, allowing side-channel attacks. |
CVE-2015-0565 | NaCl in 2015 allowed the CLFLUSH instruction, making Rowhammer attacks possible. |
잠재적 완화 방법
Phases : Architecture and Design // Implementation탐지 방법
Manual Analysis
Perform a security evaluation of system-level architecture and design with software-aided physical attacks in scope.Automated Dynamic Analysis
효과성 : Moderate취약점 매핑 메모
근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
관련 공격 패턴
| CAPEC ID | 공격 패턴 이름 |
|---|---|
| CAPEC-624 | Hardware Fault Injection
The adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient temperature extremes, and more. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. |
| CAPEC-625 | Mobile Device Fault Injection
Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised. |
참고 자료
REF-1081
PlundervoltKit Murdock, David Oswald, Flavio D Garcia, Jo Van Bulck, Frank Piessens, Daniel Gruss.
https://plundervolt.com/
REF-1082
CLKSCREW: Exposing the Perils of Security-Oblivious Energy ManagementAdrian Tang, Simha Sethumadhavan, Salvatore Stolfo.
https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-tang.pdf
REF-1083
Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance ErrorsYoongu Kim, Ross Daly, Jeremie Kim, Ji Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, Onur Mutlu.
https://users.ece.cmu.edu/~yoonguk/papers/kim-isca14.pdf
REF-1225
Exploiting the DRAM rowhammer bug to gain kernel privilegesProject Zero.
https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
REF-1217
Security EngineeringRoss Anderson.
https://www.cl.cam.ac.uk/~rja14/musicfiles/manuscripts/SEv1.pdf
제출
| 이름 | 조직 | 날짜 | 출시일 | Version |
|---|---|---|---|---|
| Nicole Fern | Cycuity (originally submitted as Tortuga Logic) | 4.1 |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| CWE Content Team | MITRE | updated Demonstrative_Examples, Description, Maintenance_Notes, Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Functional_Areas, Maintenance_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Observed_Examples | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Description, Detection_Factors, Maintenance_Notes, Modes_of_Introduction, Name, Observed_Examples, References, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Relationships |
