2150
Phase: Implementation
Failure to use a Practical Byzantine fault method when requesting data. Lack of place to report
potentially compromised information sources. Relying on non-independent information sources
for integrity checking. Failure to report information sources that respond in the minority to incident
response procedures.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
References
[REF-1125]moparisthebest. "Validation Vulnerabilities". 2015 June 5. < https://mailarchive.ietf.org/
arch/msg/acme/s6Q5PdJP48LEUwgzrVuw_XPKCsM/ >.
[REF-1126]Josh Aas, Daniel McCarney and Roland Shoemaker. "Multi-Perspective Validation
Improves Domain Validation Security". 2020 February 9. < https://letsencrypt.org/2020/02/19/multiperspective-
validation.html >.
[REF-1127]Miguel Castro and Barbara Liskov. "Practical Byzantine Fault Tolerance and Proactive
Recovery". 2002 November 4. < https://dl.acm.org/doi/pdf/10.1145/571637.571640 >.2023-04-07.
CWE-1294: Insecure Security Identifier Mechanism
Weakness ID : 1294
Structure : Simple
Abstraction : Class
Description
The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what
actions are allowed or disallowed when a transaction originates from an entity. However, the
Security Identifiers are not correctly implemented.
Extended Description
Systems-On-Chip (Integrated circuits and hardware engines) implement Security Identifiers to
differentiate/identify actions originated from various agents. These actions could be 'read', 'write',
'program', 'reset', 'fetch', 'compute', etc. Security identifiers are generated and assigned to every
agent in the System (SoC) that is either capable of generating an action or receiving an action from
another agent. Every agent could be assigned a unique, Security Identifier based on its trust level
or privileges.
A broad class of flaws can exist in the Security Identifier process, including but not limited to
missing security identifiers, improper conversion of security identifiers, incorrect generation of
security identifiers, etc.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-1294: Insecure Security Identifier Mechanism
CWE-1294: Insecure Security Identifier Mechanism