CWE-1194 Details softwarezwakheid | CVE Find

Leveranciers en producten

CPE, wat staat voor Common Platform Enumeration, is een gestandaardiseerd schema voor het benoemen van hardware, software en besturingssystemen. CPE biedt een gestructureerd naamgevingsschema om IT-systemen, platforms en pakketten uniek te identificeren en te classificeren op basis van bepaalde attributen zoals leverancier, productnaam, versie, update, editie en taal.

Naam: Hardware Design

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

CWE-leden

CWE-1195: Manufacturing and Life Cycle Management Concerns Categorie

CWE-1195: Weaknesses in this category are root-caused to defects that arise in the semiconductor-manufacturing process or during the life cycle and supply chain.

CWE-1059: Insufficient Technical Documentation Basis

CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications Basis

CWE-1266: Improper Scrubbing of Sensitive Data from Decommissioned Device Basis

CWE-1269: Product Released in Non-Release Configuration Basis

CWE-1273: Device Unlock Credential Sharing Basis

CWE-1297: Unprotected Confidential Information on Device is Accessible by OSAT Vendors Basis

CWE-1196: Security Flow Issues Categorie

CWE-1196: Weaknesses in this category are related to improper design of full-system security flows, including but not limited to secure boot, secure update, and hardware-device attestation.

CWE-1190: DMA Device Enabled Too Early in Boot Phase Basis

CWE-1193: Power-On of Untrusted Execution Core Before Enabling Fabric Access Control Basis

CWE-1264: Hardware Logic with Insecure De-Synchronization between Control and Data Channels Basis

CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code Basis

CWE-1283: Mutable Attestation or Measurement Reporting Data Basis

CWE-1310: Missing Ability to Patch ROM Code Basis

CWE-1326: Missing Immutable Root of Trust in Hardware Basis

CWE-1328: Security Version Number Mutable to Older Versions Basis

CWE-1197: Integration Issues Categorie

CWE-1197: Weaknesses in this category are those that arise due to integration of multiple hardware Intellectual Property (IP) cores, from System-on-a-Chip (SoC) subsystem interactions, or from hardware platform subsystem interactions.

CWE-1276: Hardware Child Block Incorrectly Connected to Parent System Basis

CWE-1198: Privilege Separation and Access Control Issues Categorie

CWE-1198: Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

CWE-276: Incorrect Default Permissions Basis

CWE-441: Unintended Proxy or Intermediary Basis

CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC) Basis

CWE-1192: Improper Identifier for IP Block used in System-On-Chip (SOC) Basis

CWE-1220: Insufficient Granularity of Access Control Basis

CWE-1222: Insufficient Granularity of Address Regions Protected by Register Locks Basis

CWE-1242: Inclusion of Undocumented Features or Chicken Bits Basis

CWE-1260: Improper Handling of Overlap Between Protected Memory Ranges Basis

CWE-1262: Improper Access Control for Register Interface Basis

CWE-1267: Policy Uses Obsolete Encoding Basis

CWE-1268: Policy Privileges are not Assigned Consistently Between Control and Data Agents Basis

CWE-1280: Access Control Check Implemented After Asset is Accessed Basis

CWE-1294: Insecure Security Identifier Mechanism Basis

CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface Basis

CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) Basis

CWE-1303: Non-Transparent Sharing of Microarchitectural Resources Basis

CWE-1314: Missing Write Protection for Parametric Data Values Basis

CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses Basis

CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy Basis

CWE-1420: Exposure of Sensitive Information during Transient Execution Basis

CWE-1199: General Circuit and Logic Design Concerns Categorie

CWE-1199: Weaknesses in this category are related to hardware-circuit design and logic (e.g., CMOS transistors, finite state machines, and registers) as well as issues related to hardware description languages such as System Verilog and VHDL.

CWE-1209: Failure to Disable Reserved Bits Basis

CWE-1221: Incorrect Register Defaults or Module Parameters Basis

CWE-1223: Race Condition for Write-Once Attributes Basis

CWE-1224: Improper Restriction of Write-Once Bit Fields Basis

CWE-1231: Improper Prevention of Lock Bit Modification Basis

CWE-1232: Improper Lock Behavior After Power State Transition Basis

CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit Protection Basis

CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks Basis

CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic Basis

CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared State Basis

CWE-1253: Incorrect Selection of Fuse Values Basis

CWE-1254: Incorrect Comparison Logic Granularity Basis

CWE-1261: Improper Handling of Single Event Upsets Basis

CWE-1298: Hardware Logic Contains Race Conditions Basis

CWE-1201: Core and Compute Issues Categorie

CWE-1201: Weaknesses in this category are typically associated with CPUs, Graphics, Vision, AI, FPGA, and microcontrollers.

CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations Basis

CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior Basis

CWE-1342: Information Exposure through Microarchitectural State after Transient Execution Basis

CWE-1420: Exposure of Sensitive Information during Transient Execution Basis

CWE-1202: Memory and Storage Issues Categorie

CWE-1202: Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

CWE-226: Sensitive Information in Resource Not Removed Before Reuse Basis

CWE-1246: Improper Write Handling in Limited-write Non-Volatile Memories Basis

CWE-1251: Mirrored Regions with Different Values Basis

CWE-1257: Improper Access Control Applied to Mirrored or Aliased Memory Regions Basis

CWE-1282: Assumed-Immutable Data is Stored in Writable Memory Basis

CWE-1420: Exposure of Sensitive Information during Transient Execution Basis

CWE-1203: Peripherals, On-chip Fabric, and Interface/IO Problems Categorie

CWE-1203: Weaknesses in this category are related to hardware security problems that apply to peripheral devices, IO interfaces, on-chip interconnects, network-on-chip (NoC), and buses. For example, this category includes issues related to design of hardware interconnect and/or protocols such as PCIe, USB, SMBUS, general-purpose IO pins, and user-input peripherals such as mouse and keyboard.

CWE-1311: Improper Translation of Security Attributes by Fabric Bridge Basis

CWE-1312: Missing Protection for Mirrored Regions in On-Chip Fabric Firewall Basis

CWE-1315: Improper Setting of Bus Controlling Capability in Fabric End-point Basis

CWE-1316: Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges Basis

CWE-1317: Improper Access Control in Fabric Bridge Basis

CWE-1331: Improper Isolation of Shared Resources in Network On Chip (NoC) Basis

CWE-1205: Security Primitives and Cryptography Issues Categorie

CWE-1205: Weaknesses in this category are related to hardware implementations of cryptographic protocols and other hardware-security primitives such as physical unclonable functions (PUFs) and random number generators (RNGs).

CWE-203: Observable Discrepancy Basis

CWE-325: Missing Cryptographic Step Basis

CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation Basis

CWE-1241: Use of Predictable Algorithm in Random Number Generator Basis

CWE-1279: Cryptographic Operations are Run Before Supporting Units are Ready Basis

CWE-1351: Improper Handling of Hardware Behavior in Exceptionally Cold Environments Basis

CWE-1431: Driving Intermediate Cryptographic State/Results to Hardware Module Outputs Basis

CWE-1206: Power, Clock, Thermal, and Reset Concerns Categorie

CWE-1206: Weaknesses in this category are related to system power, voltage, current, temperature, clocks, system state saving/restoring, and resets at the platform and SoC level.

CWE-1232: Improper Lock Behavior After Power State Transition Basis

CWE-1247: Improper Protection Against Voltage and Clock Glitches Basis

CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications Basis

CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks Basis

CWE-1256: Improper Restriction of Software Interfaces to Hardware Features Basis

CWE-1271: Uninitialized Value on Reset for Registers Holding Security Settings Basis

CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation Basis

CWE-1314: Missing Write Protection for Parametric Data Values Basis

CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals Basis

CWE-1332: Improper Handling of Faults that Lead to Instruction Skips Basis

CWE-1338: Improper Protections Against Hardware Overheating Basis

CWE-1207: Debug and Test Problems Categorie

CWE-1207: Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

CWE-1191: On-Chip Debug and Test Interface With Improper Access Control Basis

CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks Basis

CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug Basis

CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State Basis

CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information Basis

CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition Basis

CWE-1291: Public Key Re-Use for Signing both Debug and Production Code Basis

CWE-1295: Debug Messages Revealing Unnecessary Information Basis

CWE-1296: Incorrect Chaining or Granularity of Debug Components Basis

CWE-1313: Hardware Allows Activation of Test or Debug Logic at Runtime Basis

CWE-1323: Improper Management of Sensitive Trace Data Basis

CWE-319: Cleartext Transmission of Sensitive Information Basis

CWE-1208: Cross-Cutting Problems Categorie

CWE-1208: Weaknesses in this category can arise in multiple areas of hardware design or can apply to a wide cross-section of components.

CWE-440: Expected Behavior Violation Basis

CWE-1053: Missing Documentation for Design Basis

CWE-1059: Insufficient Technical Documentation Basis

CWE-1263: Improper Physical Access Control Basis

CWE-1277: Firmware Not Updateable Basis

CWE-1301: Insufficient or Incomplete Data Removal within Hardware Component Basis

CWE-1329: Reliance on Component That is Not Updateable Basis

CWE-1357: Reliance on Insufficiently Trustworthy Component Basis

CWE-1429: Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface Basis

CWE-1388: Physical Access Issues and Concerns Categorie

CWE-1388: Weaknesses in this category are related to concerns of physical access.

CWE-1384: Improper Handling of Physical or Environmental Conditions Basis

CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI) Basis

CWE-1247: Improper Protection Against Voltage and Clock Glitches Basis

CWE-1261: Improper Handling of Single Event Upsets Basis

CWE-1332: Improper Handling of Faults that Lead to Instruction Skips Basis

CWE-1351: Improper Handling of Hardware Behavior in Exceptionally Cold Environments Basis

CWE-1278: Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques Basis

CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks Basis

CWE-1300: Improper Protection of Physical Side Channels Basis

CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications Basis

CWE-weergave-informatie

Notities kwetsbaarheidsmapping

Rechtvaardiging : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Opmerking : Use this View or other Views to search and navigate for the appropriate weakness.

Notities

This view attempts to present hardware weaknesses in a simple and intuitive way. As such it uses a single level of abstraction. The same category could contain weaknesses that have parent/child relationships within View-1000. By exploring View-1000 relationships for the weaknesses that are included, one can find deeper relationships between some hardware weaknesses.
The top level categories in this view represent commonly understood areas/terms within hardware design, and are meant to aid the user in identifying potential related weaknesses. It is possible for the same weakness to exist within multiple different categories.

Doelgroep

Belanghebbende	Beschrijving
Hardware Designers	Hardware Designers use this view to better understand potential mistakes that can be made in specific areas of their IP design. The use of concepts with which hardware designers are familiar makes it easier to navigate.
Educators	Educators use this view to teach future professionals about the types of mistakes that are commonly made in hardware design.

Indiening

Naam	Organisatie	Datum	Releasedatum	Version
CWE Content Team	MITRE	2019-12-27 +00:00	2020-02-24 +00:00	4.0

Wijzigingen

Naam	Organisatie	Datum	Opmerking
CWE Content Team	MITRE	2022-06-28 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2026-10-28 +00:00	updated Other_Notes, Relationship_Notes

De informatie die op CVE Find wordt gepresenteerd, is afkomstig van verschillende zorgvuldig geselecteerde referentiebronnen. CVE-gegevens worden geleverd door MITRE Corporation en de National Vulnerability Database (NVD). De Known Exploited Vulnerabilities (KEV)-catalogus is afkomstig van de Cybersecurity and Infrastructure Security Agency (CISA), terwijl EPSS-scores afkomstig zijn van FIRST.org. Daarnaast worden gegevens over softwarezwakheden (CWE) en veelvoorkomende aanvalspatronen (CAPEC) bijgehouden door MITRE Corporation, en informatie over hardware- en softwareconfiguraties (CPE) wordt geleverd door de NVD.