2212
Reference Description
CVE-2020-36049 JavaScript-based packet decoder uses concatenation of many small strings,
causing out-of-memory (OOM) condition
https://www.cve.org/CVERecord?id=CVE-2020-36049
CVE-2019-20176 Product allocates a new buffer on the stack for each file in a directory, allowing
stack exhaustion
https://www.cve.org/CVERecord?id=CVE-2019-20176
CVE-2013-1591 Chain: an integer overflow (CWE-190) in the image size calculation causes
an infinite loop (CWE-835) which sequentially allocates buffers without limits
(CWE-1325) until the stack is full.
https://www.cve.org/CVERecord?id=CVE-2013-1591
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Related Attack Patterns
CAPEC-ID Attack Pattern Name
130 Excessive Allocation
CWE-1326: Missing Immutable Root of Trust in Hardware
Weakness ID : 1326
Structure : Simple
Abstraction : Base
Description
A missing immutable root of trust in the hardware results in the ability to bypass secure boot or
execute untrusted or adversarial boot code.
Extended Description
A System-on-Chip (SoC) implements secure boot by verifying or authenticating signed boot code.
The signing of the code is achieved by an entity that the SoC trusts. Before executing the boot
code, the SoC verifies that the code or the public key with which the code has been signed has not
been tampered with. The other data upon which the SoC depends are system-hardware settings
in fuses such as whether "Secure Boot is enabled". These data play a crucial role in establishing a
Root of Trust (RoT) to execute secure-boot flows.
One of the many ways RoT is achieved is by storing the code and data in memory or fuses.
This memory should be immutable, i.e., once the RoT is programmed/provisioned in memory,
that memory should be locked and prevented from further programming or writes. If the memory
contents (i.e., RoT) are mutable, then an adversary can modify the RoT to execute their choice of
code, resulting in a compromised secure boot.
Note that, for components like ROM, secure patching/update features should be supported to allow
authenticated and authorized updates in the field.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-1326: Missing Immutable Root of Trust in Hardware
CWE-1326: Missing Immutable Root of Trust in Hardware