CWE-1283 Detalhe

The register contents used for attestation or measurement reporting data to verify boot flow are modifiable by an adversary.

Modos de Introdução

Architecture and Design : Such issues can be introduced during hardware architecture or design and can be identified later during Testing or System Configuration phases.
Implementation : If the access-controls which protecting the reporting registers are misconfigured during implementation, this weakness can arise.

Plataformas Aplicáveis

Linguagem

Class: Not Language-Specific (Undetermined)

Sistemas Operacionais

Class: Not OS-Specific (Undetermined)

Arquiteturas

Class: Not Architecture-Specific (Undetermined)

Tecnologias

Class: Not Technology-Specific (Undetermined)

Consequências Comuns

Mitigações Potenciais

Phases : Architecture and Design

Notas de Mapeamento de Vulnerabilidade

Justificativa : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comentário : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Padrões de Ataque Relacionados

Notas

This entry is still in development and will continue to see updates and content improvements.

Referências

REF-1107

PCIe Device Measurement Requirements
Intel Corporation.
https://www.intel.com/content/dam/www/public/us/en/documents/reference-guides/pcie-device-security-enhancements.pdf

REF-1131

BIOS Chronomancy: Fixing the Core Root of Trust for Measurement
John Butterworth, Cory Kallenberg, Xeno Kovah.
https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-Slides.pdf

Submissão

Modificações