2098
If the AES_KEY_CONTROL_POLICY register value is 0x00000010, the lower 8 bits will be 0001
0000. This will give Agent 4, a trusted agent, write access to AES_KEY_WRITE_POLICY, but
Agent 3, who is untrusted, will not have write access. The Policy register values should therefore
be as follows:
Example Language: (Good)
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1198 Privilege Separation and Access Control Issues 1194 2470
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
This entry is still under development and will continue to see updates and content improvements.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
180 Exploiting Incorrectly Configured Access Control Security Levels
CWE-1269: Product Released in Non-Release Configuration
Weakness ID : 1269
Structure : Simple
Abstraction : Base
Description
The product released to market is released in pre-production or manufacturing configuration.
Extended Description
Products in the pre-production or manufacturing stages are configured to have many debug hooks
and debug capabilities, including but not limited to:
• Ability to override/bypass various cryptographic checks (including authentication,
authorization, and integrity)
• Ability to read/write/modify/dump internal state (including registers and memory)
• Ability to change system configurations
• Ability to run hidden or private commands that are not allowed during production (as they
expose IP).
The above is by no means an exhaustive list, but it alludes to the greater capability and the greater
state of vulnerability of a product during it's preproduction or manufacturing state.
Complexity increases when multiple parties are involved in executing the tests before the final
production version. For example, a chipmaker might fabricate a chip and run its own preproduction
tests, following which the chip would be delivered to the Original Equipment Manufacturer (OEM),
who would now run a second set of different preproduction tests on the same chip. Only after both
of these sets of activities are complete, can the overall manufacturing phase be called "complete"
and have the "Manufacturing Complete" fuse blown. However, if the OEM forgets to blow the
CWE Version 4.14
CWE-1269: Product Released in Non-Release Configuration
CWE-1269: Product Released in Non-Release Configuration