The product uses an obsolete encoding mechanism to implement access controls.
Within a System-On-a-Chip (SoC), various circuits and hardware engines generate transactions for the purpose of accessing (read/write) assets or performing various actions (e.g., reset, fetch, compute, etc.). Among various types of message information, a typical transaction is comprised of source identity (identifying the originator of the transaction) and a destination identity (routing the transaction to the respective entity). Sometimes the transactions are qualified with a Security Token. This Security Token helps the destination agent decide on the set of allowed actions (e.g., access to an asset for reads and writes). A policy encoder is used to map the bus transactions to Security Tokens that in turn are used as access-controls/protection mechanisms. A common weakness involves using an encoding which is no longer trusted, i.e., an obsolete encoding.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| ChildOf | Discouraged | P | 284 | Improper Access Control |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1198 | Privilege Separation and Access Control Issues |
| MemberOf | Prohibited | C | 1396 | Comprehensive Categorization: Access Control |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-294 | Not Language-Specific Weaknesses |
| MemberOf | Prohibited | BS | BOSS-298 | Not OS-Specific(os class) Weaknesses |
| MemberOf | Prohibited | BS | BOSS-301 | Not Architecture-Specific (architecture class) Weaknesses |
| MemberOf | Prohibited | BS | BOSS-307 | Not Technology-Specific (technology class) Weaknesses |
| MemberOf | Prohibited | BS | BOSS-311 | Execute Unauthorized Code or Commands (impact) |
| MemberOf | Prohibited | BS | BOSS-316 | Bypass Protection Mechanism (impact) |
| MemberOf | Prohibited | BS | BOSS-317 | Reduce Reliability (impact) |
| MemberOf | Prohibited | BS | BOSS-319 | Read Files or Directories (impact) |
| MemberOf | Prohibited | BS | BOSS-320 | Modify Files or Directories (impact) |
| MemberOf | Prohibited | BS | BOSS-323 | Read Memory (impact) |
| MemberOf | Prohibited | BS | BOSS-331 | Modify Memory (impact) |
| MemberOf | Prohibited | BS | BOSS-332 | Gain Privileges or Assume Identity (impact) |
| MemberOf | Prohibited | BS | BOSS-333 | DoS: Resource Consumption (Other) (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1198 | Privilege Separation and Access Control Issues |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| ConfidentialityIntegrityAvailabilityAccess Control | High | Modify MemoryRead MemoryModify Files or DirectoriesRead Files or DirectoriesDoS: Resource Consumption (Other)Execute Unauthorized Code or CommandsGain Privileges or Assume IdentityBypass Protection MechanismReduce Reliability | N/A |
Security Token Decoders should be reviewed for design inconsistency and common weaknesses.
Access and programming flows should be tested in both pre-silicon and post-silicon testing.
N/A
N/A
For example, consider a system that has four bus masters. The table below provides bus masters, their Security Tokens, and trust assumptions.
| Bus Master | Security Token Decoding | Trust Assumptions | | --- | --- | --- | | Master_0 | "00" | Untrusted | | Master_1 | "01" | Trusted | | Master_2 | "10" | Untrusted | | Master_3 | "11" | Untrusted |
The policy encoding is to be defined such that Security Token will be used in implemented access-controls. The bits in the bus transaction that contain Security-Token information are Bus_transaction [15:11]. The assets are the AES-Key registers for encryption or decryption. The key of 128 bits is implemented as a set of four, 32-bit registers.
| Register | Field description | | --- | --- | | AES_ENC_DEC_KEY_0 | AES key [0:31] for encryption or decryption, Default 0x00000000 | | AES_ENC_DEC_KEY_1 | AES key [32:63] for encryption or decryption, Default 0x00000000 | | AES_ENC_DEC_KEY_2 | AES key [64:95] for encryption or decryption, Default 0x00000000 | | AES_ENC_DEC_KEY_4 | AES key [96:127] for encryption or decryption, Default 0x00000000 |
Below is an example of a policy encoding scheme inherited from a previous project where all "ODD" numbered Security Tokens are trusted.
The inherited policy encoding is obsolete and does not work for the new system where an untrusted bus master with an odd Security Token exists in the system, i.e., Master_3 whose Security Token is "11". Based on the old policy, the untrusted bus master (Master_3) has access to the AES-Key registers. To resolve this, a register AES_KEY_ACCESS_POLICY can be defined to provide necessary, access controls:
New Policy:
| | | | AES_KEY_ACCESS_POLICY | [31:0] Default 0x00000002 - agent with Security Token "1" has access to AES_ENC_DEC_KEY_0 through AES_ENC_DEC_KEY_4 registers |
The AES_KEY_ACCESS_POLICY register defines which agents with a Security Token in the transaction can access the AES-key registers. Each bit in this 32-bit register defines a Security Token. There could be a maximum of 32 security Tokens that are allowed access to the AES-key registers. The number of the bit when set (i.e., "1") allows respective action from an agent whose identity matches the number of the bit and, if "0" (i.e., Clear), disallows the respective action to that corresponding agent. Thus, any bus master with Security Token "01" is allowed access to the AES-Key registers. Below is the Pseudo Code for policy encoding:
| Reference | Description |
|---|
| Ordinality | Description |
|---|
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|