CAPEC-681
Exploitation of Improperly Controlled Hardware Security Identifiers
Średni
Draft
2021-10-21
00h00 +00:00
00h00 +00:00
Alert dla konkretnego CAPEC
Bądź na bieżąco z wszelkimi zmianami dotyczącymi konkretnego CAPEC.
Informacje CAPEC
Wymagania wstępne
Awareness of the hardware being leveraged.Access to the hardware being leveraged.
Wymagane umiejętności
Ability to execute actions within the SoC.Intricate knowledge of the identifiers being utilized.
Łagodzenie
Review generation of security identifiers for design inconsistencies and common weaknesses.Review security identifier decoders for design inconsistencies and common weaknesses.
Test security identifier definition, access, and programming flow in both pre-silicon and post-silicon environments.
Powiązane słabości
| Nazwa słabości | |
|---|---|
CWE-1259 |
Improper Restriction of Security Token Assignment The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected. |
CWE-1267 |
Policy Uses Obsolete Encoding The product uses an obsolete encoding mechanism to implement access controls. |
CWE-1270 |
Generation of Incorrect Security Tokens The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect. |
CWE-1294 |
Insecure Security Identifier Mechanism The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented. |
CWE-1302 |
Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. A transaction is sent without a security identifier. |
Odniesienia
REF-694
PCIe Device Measurement Requirementshttps://www.intel.com/content/dam/www/public/us/en/documents/reference-guides/pcie-device-security-enhancements.pdf
REF-695
BIOS Chronomancy: Fixing the Core Root of Trust for MeasurementJohn Butterworth, Cory Kallenberg, Xeno Kovah.
https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-Slides.pdf
Zgłoszenie
| Nazwa | Organizacja | Data | Data wydania |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
