2199
levels), 16 types of outgoing transactions can be made--8 read transactions with each supported
privilege level and 8 write transactions with each supported privilege level.
Since APB PPROT can only support up to 8 transaction types, access-control checks cannot be
performed on transactions going to the slaves at the right granularity for all possible transaction
types. Thus, potentially, user code running on the CPU could maliciously corrupt the thermalshutdown-
configuration registers to burn the device, resulting in permanent denial of service.
In this scenario, only peripherals that need access protection from 8 of the 16 possible transaction
types can be connected to the APB bus. Peripherals that require protection from the remaining
8 transaction types can be connected to a different APB bus. Alternatively, a bridge could be
implemented to handle such complex scenarios before forwarding traffic to the APB bus.
Example 2:
The Open-Core-Protocol (OCP) fabric supports two configurable, width-optional signals for
transporting security attributes: MReqInfo and SRespInfo. MReqInfo is used to transport security
attributes from bus master to slave, and SRespInfo is used to transport security attributes from
slave to bus master. An SoC uses OCP to connect several bus masters, each with a unique and
immutable hardware identity, to several slaves. One of the bus masters, the CPU, reports the
privilege level (user or super user) in addition to the unique identity. One of the slaves, the powermanagement
unit, contains registers that store the thermal-shutdown limits.
Since MReqInfo and SRespInfo are not mandatory, these signals are not configured when
autogenerating RTL for the OCP fabric. Thus, the fabric cannot be used to transport security
attributes from bus masters to slave.
Code running at user-privilege level on the CPU could maliciously corrupt the thermal-shutdownconfiguration
registers to burn the device and cause permanent denial of service.
To address this, configure the fabric to include MReqInfo and SRespInfo signals and use these
to transport security identity and privilege level to perform access-control checks at the slave
interface.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1198 Privilege Separation and Access Control Issues 1194 2470
MemberOf 1413 Comprehensive Categorization: Protection Mechanism
Failure
1400 2542
Related Attack Patterns
CAPEC-ID Attack Pattern Name
1 Accessing Functionality Not Properly Constrained by ACLs
180 Exploiting Incorrectly Configured Access Control Security Levels
References
[REF-1139]ARM. "AMBA APB Protocol Specification, Version 2.0". 2010. < https://
www.eecs.umich.edu/courses/eecs373/readings/IHI0024C_amba_apb_protocol_spec.pdf >.
[REF-1140]OCP-IP. "Open Core Protocol Specification, Release 2.2". 2006. < http://
read.pudn.com/downloads95/doc/388103/OCPSpecification%202.2.pdf >.
CWE-1319: Improper Protection against Electromagnetic Fault Injection (EMFI)
CWE Version 4.14
CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI)
CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI)