2191
writes to this register must be access-protected to prevent malicious modifications to obtain buscontrolling
capability.
Phase: Implementation
For responder devices, the register bit in the fabric end-point that enables the bus controlling
capability must be set to 0 by default. This bit should not be set during secure-boot flows. Also,
writes to this register must be access-protected to prevent malicious modifications to obtain buscontrolling
capability.
Phase: System Configuration
For responder devices, the register bit in the fabric end-point that enables the bus controlling
capability must be set to 0 by default. This bit should not be set during secure-boot flows. Also,
writes to this register must be access-protected to prevent malicious modifications to obtain buscontrolling
capability.
Demonstrative Examples
Example 1:
A typical, phone platform consists of the main, compute core or CPU, a DRAM-memory chip, an
audio codec, a baseband modem, a power-management-integrated circuit ("PMIC"), a connectivity
(WiFi and Bluetooth) modem, and several other analog/RF components. The main CPU is the
only component that can control transactions, and all the other components are responder-only
devices. All the components implement a PCIe end-point to interface with the rest of the platform.
The responder devices should have the bus-control-enable bit in the PCIe-end-point register set to
0 in hardware to prevent the devices from controlling transactions to the CPU or other peripherals.
The audio-codec chip does not have the bus-controller-enable-register bit hardcoded to 0. There is
no platform-firmware flow to verify that the bus-controller-enable bit is set to 0 in all responders.
Audio codec can now master transactions to the CPU and other platform components. Potentially,
it can modify assets in other platform components to subvert system security.
Platform firmware includes a flow to check the configuration of bus-controller-enable bit in all
responder devices. If this register bit is set on any of the responders, platform firmware sets it to 0.
Ideally, the default value of this register bit should be hardcoded to 0 in RTL. It should also have
access control to prevent untrusted entities from setting this bit to become bus controllers.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1203 Peripherals, On-chip Fabric, and Interface/IO Problems 1194 2472
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
1 Accessing Functionality Not Properly Constrained by ACLs
180 Exploiting Incorrectly Configured Access Control Security Levels
References
[REF-1135]Benoit Morgan, Eric Alata, Vincent Nicomette, Mohamed Kaaniche. "Bypassing IOMMU
Protection against I/O Attacks". 2016. < https://hal.archives-ouvertes.fr/hal-01419962/document >.
[REF-1136]Colin L. Rothwell. "Exploitation from malicious PCI Express peripherals". 2019. <
https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-934.pdf >.
CWE Version 4.14
CWE-1316: Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and
Unprotected Ranges
CWE-1316: Fabric-Address Map Allows Programming of
Unwarranted Overlaps of Protected and Unprotected Ranges 2192
CWE-1316: Fabric-Address Map Allows Programming of Unwarranted
Overlaps of Protected and Unprotected Ranges
Weakness ID : 1316
Structure : Simple
Abstraction : Base
Description
The address map of the on-chip fabric has protected and unprotected regions overlapping, allowing
an attacker to bypass access control to the overlapping portion of the protected region.
Extended Description
Various ranges can be defined in the system-address map, either in the memory or in Memory-
Mapped-IO (MMIO) space. These ranges are usually defined using special range registers
that contain information, such as base address and size. Address decoding is the process of
determining for which range the incoming transaction is destined. To ensure isolation, ranges
containing secret data are access-control protected.
Occasionally, these ranges could overlap. The overlap could either be intentional (e.g. due to a
limited number of range registers or limited choice in choosing size of the range) or unintentional
(e.g. introduced by errors). Some hardware designs allow dynamic remapping of address ranges
assigned to peripheral MMIO ranges. In such designs, intentional address overlaps can be created
through misconfiguration by malicious software. When protected and unprotected ranges overlap,
an attacker could send a transaction and potentially compromise the protections in place, violating
the principle of least privilege.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Bus/Interface Hardware (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Access Control
Authorization
Bypass Protection Mechanism
Read Memory
Modify Memory
Medium
Detection Methods
Automated Dynamic Analysis
Review address map in specification to see if there are any overlapping ranges.
CWE Version 4.14
CWE-1316: Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and
Unprotected Ranges
CWE-1316: Fabric-Address Map Allows Programming of
Unwarranted Overlaps of Protected and Unprotected Ranges