COMMON WEAKNESS ENUMERATIONDraft

CWE-1253

Incorrect Selection of Fuse Values

The logic level used to set a system to a secure state relies on a fuse being unblown.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The logic level used to set a system to a secure state relies on a fuse being unblown.

Genişletilmiş açıklama

Fuses are often used to store secret data, including security configuration data. When not blown, a fuse is considered to store a logic 0, and, when blown, it indicates a logic 1. Fuses are generally considered to be one-directional, i.e., once blown to logic 1, it cannot be reset to logic 0.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Bypass Protection MechanismGain Privileges or Assume Identity

Etkilenen güvenlik alanları: Access Control, Authorization

If the logic used to determine system-security state (by leveraging the values sensed from the fuses) uses negative logic, an attacker might blow the fuse and drive the system to an insecure state.
DoS: Crash, Exit, or Restart

Etkilenen güvenlik alanları: Availability

Read Memory

Etkilenen güvenlik alanları: Confidentiality

Modify MemoryExecute Unauthorized Code or Commands

Etkilenen güvenlik alanları: Integrity

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
Logic should be designed in a way that blown fuses do not put the product into an insecure state that can be leveraged by an attacker.
CWE-1253: Common Weakness Enumeration Entry CWE-1253 · DayBreach Sözlük · DayBreach