2181
.rdata_o ( rom_rdata_patch )
);
bootrom_linux i_bootrom_linux (
.clk_i ,
.req_i ( rom_req ),
.addr_i ( rom_addr ),
.rdata_o ( rom_rdata_linux )
);
assign rom_rdata = (ariane_boot_sel_i) ? rom_rdata_linux : rom_rdata_linux;
...
The above implementation causes the ROM data to be hardcoded for the linux system
(rom_rdata_linux) regardless of the value of ariane_boot_sel_i. Therefore, the data
(rom_rdata_patch) from the patchable ROM code is never used [REF-1396].
This weakness disables the ROM's ability to be patched. If attackers uncover security
vulnerabilities in the ROM, the users must replace the entire device. Otherwise, the weakness
exposes the system to a vulnerable state forever.
A fix to this issue is to enable rom_rdata to be selected from the patchable rom (rom_rdata_patch)
[REF-1397].
Example Language: Verilog (Good)
...
bootrom i_bootrom_patch (
.clk_i ,
.req_i ( rom_req ),
.addr_i ( rom_addr ),
.rdata_o ( rom_rdata_patch )
);
bootrom_linux i_bootrom_linux (
.clk_i ,
.req_i ( rom_req ),
.addr_i ( rom_addr ),
.rdata_o ( rom_rdata_linux )
);
assign rom_rdata = (ariane_boot_sel_i) ? rom_rdata_patch : rom_rdata_linux;
...
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1196 Security Flow Issues 1194 2469
MemberOf 1415 Comprehensive Categorization: Resource Control 1400 2544
Related Attack Patterns
CAPEC-ID Attack Pattern Name
682 Exploitation of Firmware or ROM Code with Unpatchable Vulnerabilities
References
[REF-1396]"riscv_peripherals.sv line 534". 2021. < https://github.com/HACK-EVENT/hackatdac21/
blob/75e5c0700b5a02e744f006fe8a09ff3c2ccdd32d/piton/design/chip/tile/ariane/openpiton/
riscv_peripherals.sv#L534 >.2024-02-12.
[REF-1397]"Fix for riscv_peripherals.sv line 534". 2021. < https://github.com/HACK-EVENT/
hackatdac21/blob/cwe_1310_riscv_peripheral/piton/design/chip/tile/ariane/openpiton/
riscv_peripherals.sv#L534 >.2024-02-12.
CWE Version 4.14
CWE-1311: Improper Translation of Security Attributes by Fabric Bridge
CWE-1311: Improper Translation of Security Attributes by Fabric Bridge