2185
Manual Dynamic Analysis
Using an external debugger, send write transactions to mirrored regions to test if original, writeprotected
regions are modified. Similarly, send read transactions to mirrored regions to test if the
original, read-protected signals can be read.
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
The fabric firewall should apply the same protections as the original region to the mirrored
regions.
Phase: Implementation
The fabric firewall should apply the same protections as the original region to the mirrored
regions.
Demonstrative Examples
Example 1:
A memory-controller IP block is connected to the on-chip fabric in a System on Chip (SoC).
The memory controller is configured to divide the memory into four parts: one original and three
mirrored regions inside the memory. The upper two bits of the address indicate which region is
being addressed. 00 indicates the original region and 01, 10, and 11 are used to address the
mirrored regions. All four regions operate in a lock-step manner and are always synchronized. The
firewall in the on-chip fabric is programmed to protect the assets in the memory.
The firewall only protects the original range but not the mirrored regions.
The attacker (as an unprivileged user) sends a write transaction to the mirrored region. The
mirrored region has an address with the upper two bits set to "10" and the remaining bits of the
address pointing to an asset. The firewall does not block this write transaction. Once the write is
successful, contents in the protected-memory region are also updated. Thus, the attacker can
bypass existing, memory protections.
Firewall should protect mirrored regions.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1203 Peripherals, On-chip Fabric, and Interface/IO Problems 1194 2472
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
456 Infected Memory
679 Exploitation of Improperly Configured or Implemented Memory Protections
References
[REF-1134]Taku Izumi, Fujitsu Limited. "Address Range Memory Mirroring". 2016. < https://
www.fujitsu.com/jp/documents/products/software/os/linux/catalog/LinuxConJapan2016-Izumi.pdf >.
CWE-1313: Hardware Allows Activation of Test or Debug Logic at Runtime
Weakness ID : 1313
CWE Version 4.14
CWE-1313: Hardware Allows Activation of Test or Debug Logic at Runtime
CWE-1313: Hardware Allows Activation of Test or Debug Logic at Runtime