COMMON WEAKNESS ENUMERATIONDraft

CWE-1267

Policy Uses Obsolete Encoding

The product uses an obsolete encoding mechanism to implement access controls.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product uses an obsolete encoding mechanism to implement access controls.

Extended description

Within a System-On-a-Chip (SoC), various circuits and hardware engines generate transactions for the purpose of accessing (read/write) assets or performing various actions (e.g., reset, fetch, compute, etc.). Among various types of message information, a typical transaction is comprised of source identity (identifying the originator of the transaction) and a destination identity (routing the transaction to the respective entity). Sometimes the transactions are qualified with a Security Token. This Security Token helps the destination agent decide on the set of allowed actions (e.g., access to an asset for reads and writes). A policy encoder is used to map the bus transactions to Security Tokens that in turn are used as access-controls/protection mechanisms. A common weakness involves using an encoding which is no longer trusted, i.e., an obsolete encoding.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

Lifecycle phase

Implementation

Risk

What does successful exploitation lead to?

Modify MemoryRead MemoryModify Files or DirectoriesRead Files or DirectoriesDoS: Resource Consumption (Other)Execute Unauthorized Code or CommandsGain Privileges or Assume IdentityBypass Protection MechanismReduce Reliability

Affected security scopes: Confidentiality, Integrity, Availability, Access Control

Defence

How is it prevented and fixed?

Architecture and Design · Implementation

Defence to apply across several lifecycle phases

Detail
Security Token Decoders should be reviewed for design inconsistency and common weaknesses. Access and programming flows should be tested in both pre-silicon and post-silicon testing.

Effectiveness: High

CWE-1267: Common Weakness Enumeration Entry CWE-1267 · DayBreach Sözlük · DayBreach