2197
Reference Description
https://www.cve.org/CVERecord?id=CVE-2019-6260
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1203 Peripherals, On-chip Fabric, and Interface/IO Problems 1194 2472
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
122 Privilege Abuse
References
[REF-1138]Stewart Smith. "CVE-2019-6260: Gaining control of BMC from the host processor".
2019. < https://www.flamingspork.com/blog/2019/01/23/cve-2019-6260:-gaining-control-of-bmcfrom-
the-host-processor/ >.
[REF-1381]"aes0_wrapper.sv lines 72 - 78". 2021. < https://github.com/HACK-EVENT/
hackatdac21/blob/b9ecdf6068445d76d6bee692d163fededf7a9d9b/piton/design/chip/tile/ariane/src/
aes0/aes0_wrapper.sv#L72-L78 >.2024-01-16.
[REF-1382]"clint.sv line 71". 2021. < https://github.com/HACK-EVENT/hackatdac21/blob/
b9ecdf6068445d76d6bee692d163fededf7a9d9b/piton/design/chip/tile/ariane/src/clint/
clint.sv#L71C2-L71C36 >.2024-01-16.
[REF-1383]"Fix for clint.sv line 78". 2021. < https://github.com/HACK-EVENT/hackatdac21/
blob/45a004368b5a31857008834d9780536f0764f055/piton/design/chip/tile/ariane/src/clint/
clint.sv#L78 >.2024-01-16.
CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses
Weakness ID : 1318
Structure : Simple
Abstraction : Base
Description
On-chip fabrics or buses either do not support or are not configured to support privilege separation
or other security features, such as access control.
Extended Description
Certain on-chip fabrics and buses, especially simple and low-power buses, do not support security
features. Apart from data transfer and addressing ports, some fabrics and buses do not have any
interfaces to transfer privilege, immutable identity, or any other security attribute coming from the
bus master. Similarly, they do not have dedicated signals to transport security-sensitive data from
slave to master, such as completions for certain types of transactions. Few other on-chip fabrics
and buses support security features and define specific interfaces/signals for transporting security
attributes from master to slave or vice-versa. However, including these signals is not mandatory
and could be left unconfigured when generating the register-transfer-level (RTL) description for the
fabric. Such fabrics or buses should not be used to transport any security attribute coming from the
bus master. In general, peripherals with security assets should not be connected to such buses
before the transaction from the bus master reaches the bus, unless some form of access control is
performed at a fabric bridge or another intermediate module.
CWE Version 4.14
CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses
CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses