2041
CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic
Weakness ID : 1245
Structure : Simple
Abstraction : Base
Description
Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an
undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system.
Extended Description
The functionality and security of the system heavily depend on the implementation of FSMs. FSMs
can be used to indicate the current security state of the system. Lots of secure data operations and
data transfers rely on the state reported by the FSM. Faulty FSM designs that do not account for
all states, either through undefined states (left as don't cares) or through incorrect implementation,
might lead an attacker to drive the system into an unstable state from which the system cannot
recover without a reset, thus causing a DoS. Depending on what the FSM is used for, an attacker
might also gain additional privileges to launch further attacks and compromise the security
guarantees.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 684 Incorrect Provision of Specified Functionality 1505
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : System on Chip (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability
Access Control
Unexpected State
DoS: Crash, Exit, or Restart
DoS: Instability
Gain Privileges or Assume Identity
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
Define all possible states and handle all unused states through default statements. Ensure that
system defaults to a secure state.
Effectiveness = High
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic
CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic