CWE-1334
Unauthorized Error Injection Can Degrade Hardware Redundancy
Draft
2020-12-10
00h00 +00:00
00h00 +00:00
2025-12-11
00h00 +00:00
00h00 +00:00
Notificações para um CWE
Fique informado sobre quaisquer alterações para um CWE específico.
Nome: Unauthorized Error Injection Can Degrade Hardware Redundancy
An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode.
Informações Gerais
Modos de Introdução
Architecture and Design : Such issues could be introduced during hardware architecture and design and identified later during Testing or System Configuration phases.Implementation : Such issues could be introduced during implementation and identified later during Testing or System Configuration phases.
Integration : Such issues could be introduced during integration and identified later during Testing or System Configuration phases.
Plataformas Aplicáveis
Linguagem
Class: Not Language-Specific (Undetermined)Sistemas Operacionais
Class: Not OS-Specific (Undetermined)Arquiteturas
Class: Not Architecture-Specific (Undetermined)Tecnologias
Class: Not Technology-Specific (Undetermined)Consequências Comuns
| Escopo | Impacto | Probabilidade |
|---|---|---|
| Integrity Availability | DoS: Crash, Exit, or Restart, DoS: Instability, Quality Degradation, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other), Reduce Performance, Reduce Reliability, Unexpected State |
Mitigações Potenciais
Phases : Architecture and DesignEnsure the design does not allow error injection in modes intended for normal run-time operation. Provide access controls on interfaces for injecting errors.
Phases : Implementation
Disallow error injection in modes which are expected to be used for normal run-time operation. Provide access controls on interfaces for injecting errors.
Phases : Integration
Add an access control layer atop any unprotected interfaces for injecting errors.
Notas de Mapeamento de Vulnerabilidade
Justificativa : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Comentário : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Padrões de Ataque Relacionados
| CAPEC-ID | Nome do Padrão de Ataque |
|---|---|
| CAPEC-624 | Hardware Fault Injection
The adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient temperature extremes, and more. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. |
| CAPEC-625 | Mobile Device Fault Injection
Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised. |
Submissão
| Nome | Organização | Data | Data de lançamento | Version |
|---|---|---|---|---|
| James Pangburn | Accellera IP Security Assurance (IPSA) Working Group | 4.3 |
Modificações
| Nome | Organização | Data | Comentário |
|---|---|---|---|
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities |
