2127
[REF-1342]"Hackatdac19 commit_stage.sv". 2019. < https://github.com/HACKEVENT/
hackatdac19/blob/619e9fb0ef32ee1e01ad76b8732a156572c65700/src/
commit_stage.sv#L287:L290 >.2023-06-21.
[REF-1343]Florian Zaruba, Michael Schaffner, Stefan Mach and Andreas
Traber. "commit_stage.sv". 2018. < https://github.com/openhwgroup/cva6/
blob/7951802a0147aedb21e8f2f6dc1e1e9c4ee857a2/src/commit_stage.sv#L296:L301
>.2023-06-21.
CWE-1282: Assumed-Immutable Data is Stored in Writable Memory
Weakness ID : 1282
Structure : Simple
Abstraction : Base
Description
Immutable data, such as a first-stage bootloader, device identifiers, and "write-once" configuration
settings are stored in writable memory that can be re-programmed or updated in the field.
Extended Description
Security services such as secure boot, authentication of code and data, and device attestation
all require assets such as the first stage bootloader, public keys, golden hash digests, etc.
which are implicitly trusted. Storing these assets in read-only memory (ROM), fuses, or one-time
programmable (OTP) memory provides strong integrity guarantees and provides a root of trust for
securing the rest of the system. Security is lost if assets assumed to be immutable can be modified.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
CanPrecede 471 Modification of Assumed-Immutable Data (MAID) 1121
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Varies by Context
Potential Mitigations
Phase: Implementation
All immutable code or data should be programmed into ROM or write-once memory.
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-1283: Mutable Attestation or Measurement Reporting Data
CWE-1283: Mutable Attestation or Measurement Reporting Data