CWE-1292: Incorrect Conversion of Security Identifiers
Description
The product implements a conversion mechanism to map certain bus-transaction signals to security identifiers. However, if the conversion is incorrectly implemented, untrusted agents can gain unauthorized access to the asset.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- ConfidentialityIntegrityAvailabilityAccess Control
Modify Memory; Read Memory; DoS: Resource Consumption (Other); Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity; Quality Degradation
Potential mitigations
- Architecture and Design
Security identifier decoders must be reviewed for design inconsistency and common weaknesses.
- Implementation
Access and programming flows must be tested in pre-silicon and post-silicon testing.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.