2193
Effectiveness = High
Manual Static Analysis
Negative testing of access control on overlapped ranges.
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
When architecting the address map of the chip, ensure that protected and unprotected ranges
are isolated and do not overlap. When designing, ensure that ranges hardcoded in Register-
Transfer Level (RTL) do not overlap.
Phase: Implementation
Ranges configured by firmware should not overlap. If overlaps are mandatory because of
constraints such as a limited number of registers, then ensure that no assets are present in the
overlapped portion.
Phase: Testing
Validate mitigation actions with robust testing.
Demonstrative Examples
Example 1:
An on-chip fabric supports a 64KB address space that is memory-mapped. The fabric has two
range registers that support creation of two protected ranges with specific size constraints--4KB,
8KB, 16KB or 32KB. Assets that belong to user A require 4KB, and those of user B require 20KB.
Registers and other assets that are not security-sensitive require 40KB. One range register is
configured to program 4KB to protect user A's assets. Since a 20KB range cannot be created with
the given size constraints, the range register for user B's assets is configured as 32KB. The rest
of the address space is left as open. As a result, some part of untrusted and open-address space
overlaps with user B range.
The fabric does not support least privilege, and an attacker can send a transaction to the
overlapping region to tamper with user B data.
Since range B only requires 20KB but is allotted 32KB, there is 12KB of reserved space.
Overlapping this region of user B data, where there are no assets, with the untrusted space will
prevent an attacker from tampering with user B data.
Observed Examples
Reference Description
CVE-2009-4419 Attacker can modify MCHBAR register to overlap with an attacker-controlled
region, which modification prevents the SENTER instruction from properly
applying VT-d protection while a Measured Launch Environment is being
launched.
https://www.cve.org/CVERecord?id=CVE-2009-4419
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1203 Peripherals, On-chip Fabric, and Interface/IO Problems 1194 2472
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
CWE Version 4.14
CWE-1317: Improper Access Control in Fabric Bridge
CWE-1317: Improper Access Control in Fabric Bridge