COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1245

Improper Finite State Machines (FSMs) in Hardware Logic

Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system.

Genişletilmiş açıklama

The functionality and security of the system heavily depend on the implementation of FSMs. FSMs can be used to indicate the current security state of the system. Lots of secure data operations and data transfers rely on the state reported by the FSM.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Unexpected StateDoS: Crash, Exit, or RestartDoS: InstabilityGain Privileges or Assume Identity

Etkilenen güvenlik alanları: Availability, Access Control

Faulty FSM designs that do not account for all states, either through undefined states (left as don't cares) or through incorrect implementation, might lead an attacker to drive the system into an unstable state from which the system cannot recover without a reset, thus causing a DoS. Depending on what the FSM is used for, an attacker might also gain additional privileges to launch further attacks and compromise the security guarantees.

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design · Implementation

Birden fazla yaşam döngüsü evresinde uygulanacak savunma

Detay
Define all possible states and handle all unused states through default statements. Ensure that system defaults to a secure state.

Etkinlik: High

CWE-1245: Common Weakness Enumeration Entry CWE-1245 · DayBreach Sözlük · DayBreach