2161
However, the above code [REF-1394] allows the values of pmpaddr_i and pmpcfg_i to be changed
through DMA's input ports. This causes a race condition and will enable attackers to access
sensitive addresses that the configuration is not associated with.
Attackers can initialize the DMA access process (CTRL_IDLE) using pmpcfg_i for a non-privileged
PMP address (pmpaddr_i). Then during the loading state (CTRL_LOAD), attackers can replace
the non-privileged address in pmpaddr_i with a privileged address without the requisite authorized
access configuration.
To fix this issue (see [REF-1395]), the value of the pmpaddr_i and pmpcfg_i signals should be
stored in local registers (pmpaddr_reg and pmpcfg_reg at the start of the DMA access process
and the pmp module should reference those registers instead of the signals directly. The values of
the registers can only be updated at the start (CTRL_IDLE) or the end (CTRL_DONE) of the DMA
access process, which prevents attackers from changing the PMP address in the middle of the
DMA access process.
Example Language: Verilog (Good)
module dma # (...)(...);
...
input [7:0] [16-1:0] pmpcfg_i;
input logic [16-1:0][53:0] pmpaddr_i;
...
reg [7:0] [16-1:0] pmpcfg_reg;
reg [16-1:0][53:0] pmpaddr_reg;
...
//// Save the input command
always @ (posedge clk_i or negedge rst_ni)
begin: save_inputs
if (!rst_ni)
begin
...
pmpaddr_reg <= 'b0 ;
pmpcfg_reg <= 'b0 ;
end
else
begin
if (dma_ctrl_reg == CTRL_IDLE || dma_ctrl_reg == CTRL_DONE)
begin
...
pmpaddr_reg <= pmpaddr_i;
pmpcfg_reg <= pmpcfg_i;
end
end
end // save_inputs
...
// Load/store PMP check
pmp #(
.XLEN ( 64 ),
.PMP_LEN ( 54 ),
.NR_ENTRIES ( 16 )
) i_pmp_data (
.addr_i ( pmp_addr_reg ),
.priv_lvl_i ( riscv::PRIV_LVL_U ), // we intend to apply filter on
// DMA always, so choose the least privilege .access_type_i ( pmp_access_type_reg ),
// Configuration
.conf_addr_i ( pmpaddr_reg ),
.conf_i ( pmpcfg_reg ),
.allow_o ( pmp_data_allow )
);
endmodule
MemberOf Relationships
CWE Version 4.14
CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface
CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface