Szczegóły CWE-1283

The register contents used for attestation or measurement reporting data to verify boot flow are modifiable by an adversary.

Sposoby wprowadzenia

Architecture and Design : Such issues can be introduced during hardware architecture or design and can be identified later during Testing or System Configuration phases.
Implementation : If the access-controls which protecting the reporting registers are misconfigured during implementation, this weakness can arise.

Odpowiednie platformy

Język

Class: Not Language-Specific (Undetermined)

Systemy operacyjne

Class: Not OS-Specific (Undetermined)

Architektury

Class: Not Architecture-Specific (Undetermined)

Technologie

Class: Not Technology-Specific (Undetermined)

Typowe konsekwencje

Potencjalne środki zaradcze

Phases : Architecture and Design

Uwagi dotyczące mapowania podatności

Uzasadnienie : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentarz : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Powiązane wzorce ataków

Notatki

This entry is still in development and will continue to see updates and content improvements.

Odniesienia

REF-1107

PCIe Device Measurement Requirements
Intel Corporation.
https://www.intel.com/content/dam/www/public/us/en/documents/reference-guides/pcie-device-security-enhancements.pdf

REF-1131

BIOS Chronomancy: Fixing the Core Root of Trust for Measurement
John Butterworth, Cory Kallenberg, Xeno Kovah.
https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-Slides.pdf

Zgłoszenie

Modyfikacje