1019
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Bypass Protection Mechanism
Potential Mitigations
Phase: Architecture and Design
Identify all alternate channels and use the same protection mechanisms that are used for the
primary channels.
Demonstrative Examples
Example 1:
Register SECURE_ME is located at address 0xF00. A mirror of this register called
COPY_OF_SECURE_ME is at location 0x800F00. The register SECURE_ME is protected from
malicious agents and only allows access to select, while COPY_OF_SECURE_ME is not.
Access control is implemented using an allowlist (as indicated by acl_oh_allowlist). The identity
of the initiator of the transaction is indicated by the one hot input, incoming_id. This is checked
against the acl_oh_allowlist (which contains a list of initiators that are allowed to access the asset).
Though this example is shown in Verilog, it will apply to VHDL as well.
Example Language: Verilog (Informative)
module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n);
output [31:0] data_out;
input [31:0] data_in, incoming_id, address;
input clk, rst_n;
wire write_auth, addr_auth;
reg [31:0] data_out, acl_oh_allowlist, q;
assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0;
always @*
acl_oh_allowlist <= 32'h8312;
assign addr_auth = (address == 32'hF00) ? 1: 0;
always @ (posedge clk or negedge rst_n)
if (!rst_n)
begin
q <= 32'h0;
data_out <= 32'h0;
end
else
begin
q <= (addr_auth & write_auth) ? data_in: q;
data_out <= q;
end
end
endmodule
Example Language: Verilog (Bad)
assign addr_auth = (address == 32'hF00) ? 1: 0;
The bugged line of code is repeated in the Bad example above. The weakness arises from
the fact that the SECURE_ME register can be modified by writing to the shadow register
COPY_OF_SECURE_ME. The address of COPY_OF_SECURE_ME should also be included in
the check. That buggy line of code should instead be replaced as shown in the Good Code Snippet
below.
CWE Version 4.14
CWE-421: Race Condition During Access to Alternate Channel
CWE-421: Race Condition During Access to Alternate Channel