2109
Extended Description
Adversaries could bypass the secure-boot process and execute their own untrusted, malicious boot
code.
As a part of a secure-boot process, the read-only-memory (ROM) code for a System-on-Chip (SoC)
or other system fetches bootloader code from Non-Volatile Memory (NVM) and stores the code in
Volatile Memory (VM), such as dynamic, random-access memory (DRAM) or static, random-access
memory (SRAM). The NVM is usually external to the SoC, while the VM is internal to the SoC. As
the code is transferred from NVM to VM, it is authenticated by the SoC's ROM code.
If the volatile-memory-region protections or access controls are insufficient to prevent modifications
from an adversary or untrusted agent, the secure boot may be bypassed or replaced with the
execution of an adversary's code.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control
Integrity
Modify Memory
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity
High
Detection Methods
Manual Analysis
Ensure the volatile memory is lockable or has locks. Ensure the volatile memory is locked for
writes from untrusted agents or adversaries. Try modifying the volatile memory from an untrusted
agent, and ensure these writes are dropped.
Effectiveness = High
Manual Analysis
Analyze the device using the following steps: Identify all fabric master agents that are active
during system Boot Flow when initial code is loaded from Non-volatile storage to volatile
memory. Identify the volatile memory regions that are used for storing loaded system executable
program. During system boot, test programming the identified memory regions in step 2 from all
the masters identified in step 1. Only trusted masters should be allowed to write to the memory
CWE Version 4.14
CWE-1275: Sensitive Cookie with Improper SameSite Attribute
CWE-1275: Sensitive Cookie with Improper SameSite Attribute