2218
Technology : Security Hardware (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Authentication
Authorization
Other
Impact includes roll-back or downgrade to a vulnerable
version of the firmware or DoS (prevent upgrades).
High
Detection Methods
Automated Dynamic Analysis
Mutability of stored security version numbers and programming with older firmware images
should be part of automated testing.
Effectiveness = High
Architecture or Design Review
Anti-roll-back features should be reviewed as part of Architecture or Design review.
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
When architecting the system, security version data should be designated for storage in registers
that are either read-only or have access controls that prevent modification by an untrusted agent.
Phase: Implementation
During implementation and test, security version data should be demonstrated to be read-only
and access controls should be validated.
Demonstrative Examples
Example 1:
A new version of firmware is signed with a security version number higher than the previous
version. During the firmware update process the SoC checks for the security version number
and upgrades the SoC firmware with the latest version. This security version number is stored in
persistent memory upon successful upgrade for use across power-on resets.
In general, if the security version number is mutable, the implementation is vulnerable. A mutable
security version number allows an adversary to change the security version to a lower value to
allow roll-back or to a higher value to prevent future upgrades.
The security version number should be stored in immutable hardware such as fuses, and the writes
to these fuses should be highly access-controlled with appropriate authentication and authorization
protections.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1196 Security Flow Issues 1194 2469
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CWE Version 4.14
CWE-1329: Reliance on Component That is Not Updateable
CWE-1329: Reliance on Component That is Not Updateable