2017
The example code [REF-1375] illustrates an instance of a vulnerable implementation of register
locks in the SoC. In this flawed implementation [REF-1375], the reglk_mem registers are also being
reset when the system enters debug mode (indicated by the jtag_unlock signal). Consequently,
users can simply put the processor in debug mode to access sensitive contents that are supposed
to be protected by the register lock feature.
This can be mitigated by excluding debug mode signals from the reset logic of security-critical
register locks as demonstrated in the following code snippet [REF-1376].
Example Language: Verilog (Good)
...
always @(posedge clk_i)
begin
if(~(rst_ni && ~rst_9))
begin
for (j=0; j < 6; j=j+1) begin
reglk_mem[j] <= 'h0;
end
end
...
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1199 General Circuit and Logic Design Concerns 1194 2471
MemberOf 1207 Debug and Test Problems 1194 2474
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Related Attack Patterns
CAPEC-ID Attack Pattern Name
176 Configuration/Environment Manipulation
References
[REF-1375]"reglk_wrapper.sv". 2021. < https://github.com/HACK-EVENT/hackatdac21/
blob/cde1d9d6888bffab21d4b405ccef61b19c58dd3c/piton/design/chip/tile/ariane/src/reglk/
reglk_wrapper.sv#L80C1-L80C48 >.2023-12-13.
[REF-1376]"Fix for reglk_wrapper.sv". 2021. < https://github.com/HACK-EVENT/hackatdac21/
blob/20238068b385d7ab704cabfb95ff95dd6e56e1c2/piton/design/chip/tile/ariane/src/reglk/
reglk_wrapper.sv#L80 >.2023-12-13.
CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance
Critical Operations
Weakness ID : 1235
Structure : Simple
Abstraction : Base
Description
The code uses boxed primitives, which may introduce inefficiencies into performance-critical
operations.
Extended Description
CWE Version 4.14
CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations
CWE-1235: Incorrect Use of Autoboxing and
Unboxing for Performance Critical Operations 2018
Languages such as Java and C# support automatic conversion through their respective compilers
from primitive types into objects of the corresponding wrapper classes, and vice versa. For
example, a compiler might convert an int to Integer (called autoboxing) or an Integer to int (called
unboxing). This eliminates forcing the programmer to perform these conversions manually, which
makes the code cleaner.
However, this feature comes at a cost of performance and can lead to resource exhaustion and
impact availability when used with generic collections. Therefore, they should not be used for
scientific computing or other performance critical operations. They are only suited to support
"impedance mismatch" between reference types and primitives.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 400 Uncontrolled Resource Consumption 964
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1006 Bad Coding Practices 2422
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Language : C# (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
DoS: Resource Consumption (Other)
Reduce Performance
Incorrect autoboxing/unboxing would result in reduced
performance, which sometimes can lead to resource
consumption issues.
Low
Potential Mitigations
Phase: Implementation
Use of boxed primitives should be limited to certain situations such as when calling methods
with typed parameters. Examine the use of boxed primitives prior to use. Use SparseArrays or
ArrayMap instead of HashMap to avoid performance overhead.
Demonstrative Examples
Example 1:
Java has a boxed primitive for each primitive type. A long can be represented with the boxed
primitive Long. Issues arise where boxed primitives are used when not strictly necessary.
CWE Version 4.14
CWE-1236: Improper Neutralization of Formula Elements in a CSV File
CWE-1236: Improper Neutralization of Formula Elements in a CSV File