CWE-1271
Uninitialized Value on Reset for Registers Holding Security Settings
2020-02-24
00h00 +00:00
00h00 +00:00
Powiadomienia dla konkretnego CWE
Bądź na bieżąco z wszelkimi zmianami dotyczącymi konkretnego CWE.
Nazwa: Uninitialized Value on Reset for Registers Holding Security Settings
Security-critical logic is not set to a known value on reset.
Informacje ogólne
Sposoby wprowadzenia
ImplementationOdpowiednie platformy
Język
Klasa: Not Language-Specific (Undetermined)Systemy operacyjne
Klasa: Not OS-Specific (Undetermined)Architektury
Klasa: Not Architecture-Specific (Undetermined)Technologie
Klasa: Not Technology-Specific (Undetermined)Typowe konsekwencje
| Zakres | Wpływ | Prawdopodobieństwo |
|---|---|---|
| Access Control Authentication Authorization | Varies by Context Uwaga: When the device is first brought out of reset, the state of registers will be indeterminate if they have not been initialized by the logic. Before the registers are initialized, there will be a window during which the device is in an insecure state and may be vulnerable to attack. |
Potencjalne środki zaradcze
Phases : ImplementationDesign checks should be performed to identify any uninitialized flip-flops used for security-critical functions.
Phases : Architecture and Design
All registers holding security-critical information should be set to a specific value on reset.
Uwagi dotyczące mapowania podatności
Uzasadnienie : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Komentarz : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Powiązane wzorce ataków
| CAPEC ID | Nazwa wzorca ataku |
|---|---|
| CAPEC-74 | Manipulating State
|
Notatki
This entry is still under development and will continue to see updates and content improvements.Zgłoszenie
| Nazwa | Organizacja | Data | Data wydania | Version |
|---|---|---|---|---|
| Nicole Fern | Cycuity (originally submitted as Tortuga Logic) | 4.1 |
Modyfikacje
| Nazwa | Organizacja | Data | Komentarz |
|---|---|---|---|
| CWE Content Team | MITRE | updated Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, Name, Potential_Mitigations, Related_Attack_Patterns, Relationships | |
| CWE Content Team | MITRE | updated Name, Type | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Common_Consequences, Description |
