2179
Functional Areas
• Power
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1206 Power, Clock, Thermal, and Reset Concerns 1194 2473
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
176 Configuration/Environment Manipulation
CWE-1310: Missing Ability to Patch ROM Code
Weakness ID : 1310
Structure : Simple
Abstraction : Base
Description
Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a
vulnerable state.
Extended Description
A System or System-on-Chip (SoC) that implements a boot process utilizing security mechanisms
such as Root-of-Trust (RoT) typically starts by executing code from a Read-only-Memory (ROM)
component. The code in ROM is immutable, hence any security vulnerabilities discovered in the
ROM code can never be fixed for the systems that are already in use.
A common weakness is that the ROM does not have the ability to patch if security vulnerabilities
are uncovered after the system gets shipped. This leaves the system in a vulnerable state where
an adversary can compromise the SoC.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1329 Reliance on Component That is Not Updateable 2219
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : System on Chip (Prevalence = Undetermined)
Common Consequences
CWE Version 4.14
CWE-1310: Missing Ability to Patch ROM Code
CWE-1310: Missing Ability to Patch ROM Code