2078
The vulnerable code allows the overlap between the protected MMIO region of the AES peripheral
and the unprotected UART MMIO region. As a result, unprivileged users can access the protected
region of the AES IP. In the given vulnerable example UART MMIO region starts at address
64'h1000_0000 and ends at address 64'h1011_1000 (UARTBase is 64'h1000_0000, and the size
of the region is provided by the UARTLength of 64'h0011_1000).
On the other hand, the AES MMIO region starts at address 64'h1010_0000 and ends at address
64'h1010_1000, which implies an overlap between the two peripherals' memory regions. Thus, any
user with access to the UART can read or write the AES MMIO region, e.g., the AES secret key.
To mitigate this issue, remove the overlapping address regions by decreasing the size of the UART
memory region or adjusting memory bases for all the remaining peripherals. [REF-1339]
Example Language: Verilog (Good)
...
localparam logic[63:0] PLICLength = 64'h03FF_FFFF;
localparam logic[63:0] UARTLength = 64'h0000_1000;
localparam logic[63:0] AESLength = 64'h0000_1000;
localparam logic[63:0] SPILength = 64'h0080_0000;
...
typedef enum logic [63:0] {
...
PLICBase = 64'h0C00_0000,
UARTBase = 64'h1000_0000,
AESBase = 64'h1010_0000,
SPIBase = 64'h2000_0000,
...
Observed Examples
Reference Description
CVE-2008-7096 virtualization product allows compromise of hardware product by accessing
certain remapping registers.
https://www.cve.org/CVERecord?id=CVE-2008-7096
[REF-1100] processor design flaw allows ring 0 code to access more privileged rings
by causing a register window to overlap a range of protected system RAM
[REF-1100]
https://github.com/xoreaxeaxeax/sinkhole/blob/master/us-15-Domas-
TheMemorySinkhole-wp.pdf
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1198 Privilege Separation and Access Control Issues 1194 2470
MemberOf 1343 Weaknesses in the 2021 CWE Most Important
Hardware Weaknesses List
1343 2592
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
As of CWE 4.6, CWE-1260 and CWE-1316 are siblings under view 1000, but CWE-1260 might
be a parent of CWE-1316. More analysis is warranted.
Related Attack Patterns
CWE Version 4.14
CWE-1261: Improper Handling of Single Event Upsets
CWE-1261: Improper Handling of Single Event Upsets