2164
Register SECURE_ME is located at address 0xF00. A mirror of this register called
COPY_OF_SECURE_ME is at location 0x800F00. The register SECURE_ME is protected from
malicious agents and only allows access to select, while COPY_OF_SECURE_ME is not.
Access control is implemented using an allowlist (as indicated by acl_oh_allowlist). The identity
of the initiator of the transaction is indicated by the one hot input, incoming_id. This is checked
against the acl_oh_allowlist (which contains a list of initiators that are allowed to access the asset).
Though this example is shown in Verilog, it will apply to VHDL as well.
Example Language: Verilog (Informative)
module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n);
output [31:0] data_out;
input [31:0] data_in, incoming_id, address;
input clk, rst_n;
wire write_auth, addr_auth;
reg [31:0] data_out, acl_oh_allowlist, q;
assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0;
always @*
acl_oh_allowlist <= 32'h8312;
assign addr_auth = (address == 32'hF00) ? 1: 0;
always @ (posedge clk or negedge rst_n)
if (!rst_n)
begin
q <= 32'h0;
data_out <= 32'h0;
end
else
begin
q <= (addr_auth & write_auth) ? data_in: q;
data_out <= q;
end
end
endmodule
Example Language: Verilog (Bad)
assign addr_auth = (address == 32'hF00) ? 1: 0;
The bugged line of code is repeated in the Bad example above. The weakness arises from
the fact that the SECURE_ME register can be modified by writing to the shadow register
COPY_OF_SECURE_ME. The address of COPY_OF_SECURE_ME should also be included in
the check. That buggy line of code should instead be replaced as shown in the Good Code Snippet
below.
Example Language: Verilog (Good)
assign addr_auth = (address == 32'hF00 || address == 32'h800F00) ? 1: 0;
Observed Examples
Reference Description
CVE-2022-38399 Missing protection mechanism on serial connection allows for arbitrary OS
command execution.
https://www.cve.org/CVERecord?id=CVE-2022-38399
CVE-2020-9285 Mini-PCI Express slot does not restrict direct memory access.
https://www.cve.org/CVERecord?id=CVE-2020-9285
CVE-2020-8004 When the internal flash is protected by blocking access on the Data Bus
(DBUS), it can still be indirectly accessed through the Instruction Bus (IBUS).
https://www.cve.org/CVERecord?id=CVE-2020-8004
CWE Version 4.14
CWE-1300: Improper Protection of Physical Side Channels
CWE-1300: Improper Protection of Physical Side Channels