2080
Scope Impact Likelihood
Availability
Access Control
DoS: Crash, Exit, or Restart
DoS: Instability
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Potential Mitigations
Phase: Architecture and Design
Implement triple-modular redundancy around security-sensitive modules.
Phase: Architecture and Design
SEUs mostly affect SRAMs. For SRAMs storing security-critical data, implement Error-
Correcting-Codes (ECC) and Address Interleaving.
Demonstrative Examples
Example 1:
This is an example from [REF-1089]. See the reference for full details of this issue.
Parity is error detecting but not error correcting.
Example Language: Other (Bad)
Due to single-event upsets, bits are flipped in memories. As a result, memory-parity checks fail, which results in restart and
a temporary denial of service of two to three minutes.
Example Language: Other (Good)
Using error-correcting codes could have avoided the restart caused by SEUs.
Example 2:
In 2016, a security researcher, who was also a patient using a pacemaker, was on an airplane
when a bit flip occurred in the pacemaker, likely due to the higher prevalence of cosmic radiation
at such heights. The pacemaker was designed to account for bit flips and went into a default safe
mode, which still forced the patient to go to a hospital to get it reset. The bit flip also inadvertently
enabled the researcher to access the crash file, perform reverse engineering, and detect a hardcoded
key. [REF-1101]
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1199 General Circuit and Logic Design Concerns 1194 2471
MemberOf 1365 ICS Communications: Unreliability 1358 2502
MemberOf 1388 Physical Access Issues and Concerns 1194 2518
MemberOf 1405 Comprehensive Categorization: Improper Check or
Handling of Exceptional Conditions
1400 2531
References
[REF-1086]Fan Wang and Vishwani D. Agrawal. "Single Event Upset: An Embedded Tutorial". <
https://www.eng.auburn.edu/~agrawvd/TALKS/tutorial_6pg.pdf >.
[REF-1087]P. D. Bradley and E. Normand. "Single Event Upsets in Implantable Cardioverter
Defibrillators". < https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=736549&tag=1
>.2023-04-07.
CWE Version 4.14
CWE-1262: Improper Access Control for Register Interface
CWE-1262: Improper Access Control for Register Interface