2093
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1195 Manufacturing and Life Cycle Management Concerns 1194 2469
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Maintenance
This entry is still under development and will continue to see updates and content improvements.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
37 Retrieve Embedded Sensitive Data
150 Collect Data from Common Resource Locations
545 Pull Data from System Resources
546 Incomplete Data Deletion in a Multi-Tenant Environment
675 Retrieve Data from Decommissioned Devices
References
[REF-1080]Christopher Tarnovsky. "Security Failures in Secure Devices". < https://
www.blackhat.com/presentations/bh-europe-08/Tarnovsky/Presentation/bh-eu-08-tarnovsky.pdf >.
CWE-1267: Policy Uses Obsolete Encoding
Weakness ID : 1267
Structure : Simple
Abstraction : Base
Description
The product uses an obsolete encoding mechanism to implement access controls.
Extended Description
Within a System-On-a-Chip (SoC), various circuits and hardware engines generate transactions
for the purpose of accessing (read/write) assets or performing various actions (e.g., reset, fetch,
compute, etc.). Among various types of message information, a typical transaction is comprised
of source identity (identifying the originator of the transaction) and a destination identity (routing
the transaction to the respective entity). Sometimes the transactions are qualified with a Security
Token. This Security Token helps the destination agent decide on the set of allowed actions (e.g.,
access to an asset for reads and writes). A policy encoder is used to map the bus transactions
to Security Tokens that in turn are used as access-controls/protection mechanisms. A common
weakness involves using an encoding which is no longer trusted, i.e., an obsolete encoding.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
CWE Version 4.14
CWE-1267: Policy Uses Obsolete Encoding
CWE-1267: Policy Uses Obsolete Encoding