2196
input logic acct_ctrl_i;
...
axi_lite_interface #(...
) axi_lite_interface_i (
...
.en_o ( en_acct ),
...
..);
assign en = en_acct && acct_ctrl_i;
...
endmodule
...
module clint #(...)(...);
...
axi_lite_interface #(...
) axi_lite_interface_i (
...
.en_o ( en ),
...
);
...
endmodule
The previous code snippet [REF-1382] illustrates an instance of a vulnerable implementation of
access control for the CLINT peripheral (see module clint). It also shows a correct implementation
of access control for the AES peripheral (see module aes0_wrapper) [REF-1381]. An enable
signal (en_o) from the fabric's AXI interface (present in both modules) is used to determine if an
access request is made to the peripheral. In the case of the AES peripheral, this en_o signal is
first received in a temporary signal en_acct. Then, the access request is enabled (by asserting
the en signal) only if the request has sufficient access permissions (i.e., acct_ctrl_i signal should
be enabled). However, in the case of the CLINT peripheral, the enable signal, en_o, from the
AXI interface, is directly used to enable accesses. As a result, users with insufficient access
permissions also get full access to the CLINT peripheral.
To fix this, enable access requests to CLINT [REF-1383] only if the user has sufficient access as
indicated by the acct_ctrl_i signal in the boolean && with en_acct.
Example Language: Verilog (Good)
module clint #(...
) (
...
input logic acct_ctrl_i,
...
);
logic en, en_acct;
...
axi_lite_interface #(...
) axi_lite_interface_i (
...
.en_o ( en_acct ),
...
);
assign en = en_acct && acct_ctrl_i;
...
endmodule
Observed Examples
Reference Description
CVE-2019-6260 Baseboard Management Controller (BMC) device implements Advanced Highperformance
Bus (AHB) bridges that do not require authentication for arbitrary
read and write access to the BMC's physical address space from the host, and
possibly the network [REF-1138].
CWE Version 4.14
CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses
CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses