2102
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
DoS: Instability
DoS: Crash, Exit, or Restart
DoS: Resource Consumption (Other)
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Alter Execution Logic
Quality Degradation
Unexpected State
Reduce Maintainability
Reduce Performance
Reduce Reliability
High
Potential Mitigations
Phase: Architecture and Design
Inside the IP, incorporate integrity checking on the configuration state via a cryptographic hash.
The hash can be protected inside the IP such as by storing it in internal registers which never
lose power. Before powering down, the IP performs a hash of the configuration and saves it
in these persistent registers. Upon restore, the IP performs a hash of the saved configuration
and compares it with the saved hash. If they do not match, then the IP should not trust the
configuration.
Phase: Integration
CWE Version 4.14
CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/
Restore Operation
CWE-1304: Improperly Preserved Integrity of Hardware
Configuration State During a Power Save/Restore Operation 2178
Outside the IP, incorporate integrity checking of the configuration state via a trusted agent.
Before powering down, the trusted agent performs a hash of the configuration and saves the
hash in persistent storage. Upon restore, the IP requests the trusted agent validate its current
configuration. If the configuration hash is invalid, then the IP should not trust the configuration.
Phase: Integration
Outside the IP, incorporate a protected environment that prevents undetected modification of the
configuration state by untrusted agents. Before powering down, a trusted agent saves the IP's
configuration state in this protected location that only it is privileged to. Upon restore, the trusted
agent loads the saved state into the IP.
Demonstrative Examples
Example 1:
The following pseudo code demonstrates the power save/restore workflow which may lead to
weakness through a lack of validation of the config state after restore.
Example Language: C (Bad)
void save_config_state()
{
void* cfg;
cfg = get_config_state();
save_config_state(cfg);
go_to_sleep();
}
void restore_config_state()
{
void* cfg;
cfg = get_config_file();
load_config_file(cfg);
}
The following pseudo-code is the proper workflow for the integrity checking mitigation:
Example Language: C (Good)
void save_config_state()
{
void* cfg;
void* sha;
cfg = get_config_state();
save_config_state(cfg);
// save hash(cfg) to trusted location
sha = get_hash_of_config_state(cfg);
save_hash(sha);
go_to_sleep();
}
void restore_config_state()
{
void* cfg;
void* sha_1, sha_2;
cfg = get_config_file();
// restore hash of config from trusted memory
sha_1 = get_persisted_sha_value();
sha_2 = get_hash_of_config_state(cfg);
if (sha_1 != sha_2)
assert_error_and_halt();
load_config_file(cfg);
}
It must be noted that in the previous example of good pseudo code, the memory (where the hash of
the config state is stored) must be trustworthy while the hardware is between the power save and
restore states.
CWE Version 4.14
CWE-1310: Missing Ability to Patch ROM Code
CWE-1310: Missing Ability to Patch ROM Code