2162
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1199 General Circuit and Logic Design Concerns 1194 2471
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Related Attack Patterns
CAPEC-ID Attack Pattern Name
26 Leveraging Race Conditions
References
[REF-1115]Meher Krishna Patel. "FPGA designs with Verilog (section 7.4 Glitches)". < https://
verilogguide.readthedocs.io/en/latest/verilog/fsm.html >.
[REF-1116]Clifford E. Cummings. "Non-Blocking Assignments in Verilog Synthesis, Coding Styles
that Kill!". 2000. < http://www.sunburst-design.com/papers/CummingsSNUG2000SJ_NBA.pdf >.
[REF-1394]"dma.sv". 2021. < https://github.com/HACK-EVENT/hackatdac21/blob/main/piton/
design/chip/tile/ariane/src/dma/dma.sv >.2024-02-09.
[REF-1395]"Fix for dma.sv". 2021. < https://github.com/HACK-EVENT/hackatdac21/blob/
cwe_1298_in_dma/piton/design/chip/tile/ariane/src/dma/dma.sv >.2024-02-09.
CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface
Weakness ID : 1299
Structure : Simple
Abstraction : Base
Description
The lack of protections on alternate paths to access control-protected assets (such as unprotected
shadow registers and other external facing unguarded interfaces) allows an attacker to bypass
existing protections to the asset that are only performed against the primary path.
Extended Description
An asset inside a chip might have access-control protections through one interface. However, if
all paths to the asset are not protected, an attacker might compromise the asset through alternate
paths. These alternate paths could be through shadow or mirror registers inside the IP core, or
could be paths from other external-facing interfaces to the IP core or SoC.
Consider an SoC with various interfaces such as UART, SMBUS, PCIe, USB, etc. If access control
is implemented for SoC internal registers only over the PCIe interface, then an attacker could still
modify the SoC internal registers through alternate paths by coming through interfaces such as
UART, SMBUS, USB, etc.
Alternatively, attackers might be able to bypass existing protections by exploiting unprotected,
shadow registers. Shadow registers and mirror registers typically refer to registers that can be
accessed from multiple addresses. Writing to or reading from the aliased/mirrored address has
the same effect as writing to the address of the main register. They are typically implemented
within an IP core or SoC to temporarily hold certain data. These data will later be updated to the
main register, and both registers will be in synch. If the shadow registers are not access-protected,
attackers could simply initiate transactions to the shadow registers and compromise system
security.
Relationships
CWE Version 4.14
CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface
CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface