Tên: DMA Device Enabled Too Early in Boot Phase

The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product.

Thông tin chung

Các cách xuất hiện

Architecture and Design : DMA is included in a number of devices because it allows data transfer between the computer and the connected device, using direct hardware access to read or write directly to main memory without any OS interaction.

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)

Công nghệ

Lớp: System on Chip (Undetermined)

Hậu quả phổ biến

Phạm vi	Tác động	Khả năng xảy ra
Access Control	Bypass Protection Mechanism, Modify Memory Ghi chú: An attacker could exploit this to access secrets. DMA devices have direct write access to main memory and due to time of attack will be able to bypass OS or Bootloader access control.	High

Các biện pháp giảm thiểu tiềm năng

Phases : Architecture and Design
Utilize an IOMMU to orchestrate IO access from the start of the boot process.

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Mẫu tấn công liên quan

ID CAPEC	Tên mẫu tấn công
CAPEC-180	Exploiting Incorrectly Configured Access Control Security Levels An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.

Tài liệu tham khảo

REF-1038

DMA attack
https://en.wikipedia.org/wiki/DMA_attack

REF-1039

Thunderclap: Exploring Vulnerabilities in Operating System IOMMU Protection via DMA from Untrustworthy Peripherals
A. Theodore Markettos, Colin Rothwell, Brett F. Gutstein, Allison Pearce, Peter G. Neumann, Simon W. Moore, Robert N. M. Watson.
https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_05A-1_Markettos_paper.pdf

REF-1040

FireWire all your memory are belong to us
Maximillian Dornseif, Michael Becher, Christian N. Klein.
http://www.orkspace.net/secdocs/Conferences/CanSecWest/2005/0wn3d%20by%20an%20iPod%20-%20Firewire1394%20Issues.pdf

REF-1041

Integrating DMA attacks in exploitation frameworks
Rory Breuk, Albert Spruyt, Adam Boileau.
https://www.os3.nl/_media/2011-2012/courses/rp1/p14_report.pdf

REF-1042

Owned by an iPod
Maximillian Dornseif.
https://web.archive.org/web/20060505224959/https://pacsec.jp/psj04/psj04-dornseif-e.ppt

REF-1044

My aimful life
Dmytro Oleksiuk.
http://blog.cr4.sh/2015/09/breaking-uefi-security-with-software.html

REF-1046

Hit by a Bus:Physical Access Attacks with Firewire
A. Theodore Markettos, Adam Boileau.
https://security-assessment.com/files/presentations/ab_firewire_rux2k6-final.pdf

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi	Intel Corporation	2019-10-15 +00:00	2020-02-24 +00:00	4.0

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
CWE Content Team	MITRE	2020-08-20 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2023-04-27 +00:00	updated References, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description, Modes_of_Introduction

Chi tiết CWE-1190

CWE-1190