2214
in Read-Only Memory (ROM) or One-Time Programmable (OTP) memory that prevents further
programming or writes.
Example 2:
The example code below is a snippet from the bootrom of the HACK@DAC'19 buggy OpenPiton
SoC [REF-1348]. The contents of the bootrom are critical in implementing the hardware root of
trust.
It performs security-critical functions such as defining the system's device tree, validating the
hardware cryptographic accelerators in the system, etc. Hence, write access to bootrom should
be strictly limited to authorized users or removed completely so that bootrom is immutable. In this
example (see the vulnerable code source), the boot instructions are stored in bootrom memory,
mem. This memory can be read using the read address, addr_i, but write access should be
restricted or removed.
Example Language: Verilog (Bad)
...
always_ff @(posedge clk_i) begin
if (req_i) begin
if (!we_i) begin
raddr_q <= addr_i[$clog2(RomSize)-1+3:3];
end else begin
mem[addr_i[$clog2(RomSize)-1+3:3]] <= wdata_i;
end
end
end
...
// this prevents spurious Xes from propagating into the speculative fetch stage of the core
assign rdata_o = (raddr_q < RomSize) ? mem[raddr_q] : '0;
...
The vulnerable code shows an insecure implementation of the bootrom where bootrom can be
written directly by enabling write enable, we_i, and using write address, addr_i, and write data,
wdata_i.
To mitigate this issue, remove the write access to bootrom memory. [REF-1349]
Example Language: Verilog (Good)
...
always_ff @(posedge clk_i) begin
if (req_i) begin
raddr_q <= addr_i[$clog2(RomSize)-1+3:3];
end
end
...
// this prevents spurious Xes from propagating into the speculative fetch stage of the core
assign rdata_o = (raddr_q < RomSize) ? mem[raddr_q] : '0;
...
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1196 Security Flow Issues 1194 2469
MemberOf 1413 Comprehensive Categorization: Protection Mechanism
Failure
1400 2542
Related Attack Patterns
CWE Version 4.14
CWE-1327: Binding to an Unrestricted IP Address
CWE-1327: Binding to an Unrestricted IP Address