2083
Architecture or Design Review
Manual documentation review of the system memory map, register specification, and
permissions associated with accessing security-relevant functionality exposed via memorymapped
registers.
Effectiveness = Moderate
Fuzzing
Perform penetration testing (either manual or semi-automated with fuzzing) to verify that access
control mechanisms such as the memory protection units or on-chip bus firewall settings
adequately protect critical hardware registers from software access.
Effectiveness = Moderate
Potential Mitigations
Phase: Architecture and Design
Design proper policies for hardware register access from software.
Phase: Implementation
Ensure that access control policies for register access are implemented in accordance with the
specified design.
Demonstrative Examples
Example 1:
The register interface provides software access to hardware functionality. This functionality is an
attack surface. This attack surface may be used to run untrusted code on the system through the
register interface. As an example, cryptographic accelerators require a mechanism for software to
select modes of operation and to provide plaintext or ciphertext data to be encrypted or decrypted
as well as other functions. This functionality is commonly provided through registers.
Example Language: (Bad)
Cryptographic key material stored in registers inside the cryptographic accelerator can be accessed by software.
Example Language: (Good)
Key material stored in registers should never be accessible to software. Even if software can provide a key, all read-back
paths to software should be disabled.
Example 2:
The example code is taken from the Control/Status Register (CSR) module inside the processor
core of the HACK@DAC'19 buggy CVA6 SoC [REF-1340]. In RISC-V ISA [REF-1341], the CSR
file contains different sets of registers with different privilege levels, e.g., user mode (U), supervisor
mode (S), hypervisor mode (H), machine mode (M), and debug mode (D), with different read-write
policies, read-only (RO) and read-write (RW). For example, machine mode, which is the highest
privilege mode in a RISC-V system, registers should not be accessible in user, supervisor, or
hypervisor modes.
Example Language: Verilog (Bad)
if (csr_we || csr_read) begin
if ((riscv::priv_lvl_t'(priv_lvl_o & csr_addr.csr_decode.priv_lvl) != csr_addr.csr_decode.priv_lvl) && !
(csr_addr.address==riscv::CSR_MEPC)) begin
csr_exception_o.cause = riscv::ILLEGAL_INSTR;
csr_exception_o.valid = 1'b1;
end
// check access to debug mode only CSRs
if (csr_addr_i[11:4] == 8'h7b && !debug_mode_q) begin
csr_exception_o.cause = riscv::ILLEGAL_INSTR;
CWE Version 4.14
CWE-1262: Improper Access Control for Register Interface
CWE-1262: Improper Access Control for Register Interface