1995
However, in the example code above, while assigning distinct privileges to AXI manager and
subordinates, both the Platform-Level Interrupt Controller Specification (PLIC) and the Core-local
Interrupt Controller (CLINT) (which are peripheral numbers 6 and 7 respectively) utilize the same
access control configuration. This common configuration diminishes the granularity of the AXI
access control mechanism.
In certain situations, it might be necessary to grant higher privileges for accessing the PLIC than
those required for accessing the CLINT. Unfortunately, this differentiation is overlooked, allowing
an attacker to access the PLIC with lower privileges than intended.
As a consequence, unprivileged code can read and write to the PLIC even when it was not
intended to do so. In the worst-case scenario, the attacker could manipulate interrupt priorities,
potentially modifying the system's behavior or availability.
To address the aforementioned vulnerability, developers must enhance the AXI access control
granularity by implementing distinct access control entries for the Platform-Level Interrupt
Controller (PLIC) and the Core-local Interrupt Controller (CLINT). By doing so, different privilege
levels can be defined for accessing PLIC and CLINT, effectively thwarting the potential attacks
previously highlighted. This approach ensures a more robust and secure system, safeguarding
against unauthorized access and manipulation of interrupt priorities. [REF-1347]
Example Language: Verilog (Good)
...
for (i=0; i<NB_SUBORDINATE; i++)
begin
for (j=0; j<NB_MANAGER; j++)
begin
assign connectivity_map_o[i][j] = access_ctrl_i[i][j][priv_lvl_i];
end
end
...
Example 3:
Consider the following SoC design. The sram in HRoT has an address range that is readable and
writable by unprivileged software and it has an area that is only readable by unprivileged software.
The tbus interconnect enforces access control for subordinates on the bus but uses only one bit to
control both read and write access. Address 0xA0000000 - 0xA000FFFF is readable and writable
by the untrusted cores core{0-N} and address 0xA0010000 - 0xA001FFFF is only readable by the
untrusted cores core{0-N}.
The security policy access control is not granular enough, as it uses one bit to enable both read
and write access. This gives write access to an area that should only be readable by unprivileged
agents.
Access control logic should differentiate between read and write access and to have sufficient
address granularity.
Observed Examples
Reference Description
CVE-2022-24985 A form hosting website only checks the session authentication status for
a single form, making it possible to bypass authentication when there are
multiple forms
https://www.cve.org/CVERecord?id=CVE-2022-24985
CVE-2021-36934 An operating system has an overly permission Access Control List onsome
system files, including those related to user passwords
https://www.cve.org/CVERecord?id=CVE-2021-36934
CWE Version 4.14
CWE-1221: Incorrect Register Defaults or Module Parameters
CWE-1221: Incorrect Register Defaults or Module Parameters