CWE-1298
Hardware Logic Contains Race Conditions
2020-08-20
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Hardware Logic Contains Race Conditions
A race condition in the hardware logic results in undermining security guarantees of the system.
Thông tin chung
Các cách xuất hiện
Architecture and DesignImplementation
Nền tảng áp dụng
Ngôn ngữ
Tên: Verilog (Undetermined)Tên: VHDL (Undetermined)
Công nghệ
Lớp: System on Chip (Undetermined)Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Access Control | Bypass Protection Mechanism, Gain Privileges or Assume Identity, Alter Execution Logic Ghi chú: If timing errors occur in access control logic or finite state machines that are implemented in security sensitive flows, an attacker might exploit them to circumvent existing protections. |
Các biện pháp giảm thiểu tiềm năng
Phases : Architecture and DesignAdopting design practices that encourage designers to recognize and eliminate race conditions, such as Karnaugh maps, could result in the decrease in occurrences of race conditions.
Phases : Implementation
Logic redundancy can be implemented along security critical paths to prevent race conditions. To avoid metastability, it is a good practice in general to default to a secure state in which access is not given to untrusted agents.
Ghi chú ánh xạ lỗ hổng
Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Mẫu tấn công liên quan
| ID CAPEC | Tên mẫu tấn công |
|---|---|
| CAPEC-26 | Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file. |
Tài liệu tham khảo
REF-1115
FPGA designs with Verilog (section 7.4 Glitches)Meher Krishna Patel.
https://verilogguide.readthedocs.io/en/latest/verilog/fsm.html
REF-1116
Non-Blocking Assignments in Verilog Synthesis, Coding Styles that Kill!Clifford E. Cummings.
http://www.sunburst-design.com/papers/CummingsSNUG2000SJ_NBA.pdf
REF-1394
dma.svhttps://github.com/HACK-EVENT/hackatdac21/blob/main/piton/design/chip/tile/ariane/src/dma/dma.sv
REF-1395
Fix for dma.svhttps://github.com/HACK-EVENT/hackatdac21/blob/cwe_1298_in_dma/piton/design/chip/tile/ariane/src/dma/dma.sv
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi | Intel Corporation | 4.2 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, References | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Demonstrative_Examples, Description |
