1870
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
Read Application Data
Potential Mitigations
Phase: Architecture and Design
Thoroughly verify the data routing logic to ensure that any error handling or security checks
effectively block illegal dataflows.
Demonstrative Examples
Example 1:
There are several standard on-chip bus protocols used in modern SoCs to allow communication
between components. There are a wide variety of commercially available hardware IP
implementing the interconnect logic for these protocols. A bus connects components which initiate/
request communications such as processors and DMA controllers (bus masters) with peripherals
which respond to requests. In a typical system, the privilege level or security designation of
the bus master along with the intended functionality of each peripheral determine the security
policy specifying which specific bus masters can access specific peripherals. This security policy
(commonly referred to as a bus firewall) can be enforced using separate IP/logic from the actual
interconnect responsible for the data routing.
Example Language: Other (Bad)
The firewall and data routing logic becomes de-synchronized due to a hardware logic bug allowing components that should
not be allowed to communicate to share data. For example, consider an SoC with two processors. One is being used
as a root of trust and can access a cryptographic key storage peripheral. The other processor (application cpu) may run
potentially untrusted code and should not access the key store. If the application cpu can issue a read request to the key
store which is not blocked due to de-synchronization of data routing and the bus firewall, disclosure of cryptographic keys is
possible.
CWE Version 4.14
CWE-1265: Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
CWE-1265: Unintended Reentrant Invocation
of Non-reentrant Code Via Nested Calls 2088
Example Language: Other (Good)
All data is correctly buffered inside the interconnect until the firewall has determined that the endpoint is allowed to receive
the data.
Observed Examples
Reference Description
CVE-2017-5754 Systems with microprocessors utilizing speculative execution and indirect
branch prediction may allow unauthorized disclosure of information to an
attacker with local user access via a side-channel analysis of the data cache.
https://www.cve.org/CVERecord?id=CVE-2017-5754
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1196 Security Flow Issues 1194 2469
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Notes
Maintenance
As of CWE 4.9, members of the CWE Hardware SIG are closely analyzing this entry and others
to improve CWE's coverage of transient execution weaknesses, which include issues related to
Spectre, Meltdown, and other attacks. Additional investigation may include other weaknesses
related to microarchitectural state. As a result, this entry might change significantly in CWE 4.10.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
233 Privilege Escalation
663 Exploitation of Transient Instruction Execution
CWE-1265: Unintended Reentrant Invocation of Non-reentrant Code Via
Nested Calls
Weakness ID : 1265
Structure : Simple
Abstraction : Base
Description
During execution of non-reentrant code, the product performs a call that unintentionally produces a
nested invocation of the non-reentrant code.
Extended Description
In a complex product, a single function call may lead to many different possible code paths, some
of which may involve deeply nested calls. It may be difficult to foresee all possible code paths
that could emanate from a given function call. In some systems, an external actor can manipulate
inputs to the system and thereby achieve a wide range of possible control flows. This is frequently
a concern in products that execute scripts from untrusted sources. Examples of such products
are web browsers and PDF readers. A weakness is present when one of the possible code paths
resulting from a function call alters program state that the original caller assumes to be unchanged
during the call.
Relationships
CWE Version 4.14
CWE-1265: Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
CWE-1265: Unintended Reentrant Invocation
of Non-reentrant Code Via Nested Calls