1152
}
p1--;
return *(p1+1);
}
int main(int argc, char *argv[]) {
// initialize tos and p1 to point to the top of stack
tos = stack;
p1 = stack;
// code to add and remove items from stack
...
return 0;
}
The push method includes an expression to assign the integer value to the location in the stack
pointed to by the pointer variable.
However, this expression uses the comparison operator "==" rather than the assignment operator
"=". The result of using the comparison operator instead of the assignment operator causes
erroneous values to be entered into the stack and can cause unexpected results.
Example 3:
The example code below is taken from the CVA6 processor core of the HACK@DAC'21 buggy
OpenPiton SoC. Debug access allows users to access internal hardware registers that are
otherwise not exposed for user access or restricted access through access control protocols.
Hence, requests to enter debug mode are checked and authorized only if the processor has
sufficient privileges. In addition, debug accesses are also locked behind password checkers. Thus,
the processor enters debug mode only when the privilege level requirement is met, and the correct
debug password is provided.
The following code [REF-1377] illustrates an instance of a vulnerable implementation of debug
mode. The core correctly checks if the debug requests have sufficient privileges and enables the
debug_mode_d and debug_mode_q signals. It also correctly checks for debug password and
enables umode_i signal.
Example Language: Verilog (Bad)
module csr_regfile #(
...
// check that we actually want to enter debug depending on the privilege level we are currently in
unique case (priv_lvl_o)
riscv::PRIV_LVL_M: begin
debug_mode_d = dcsr_q.ebreakm;
...
riscv::PRIV_LVL_U: begin
debug_mode_d = dcsr_q.ebreaku;
...
assign priv_lvl_o = (debug_mode_q || umode_i) ? riscv::PRIV_LVL_M : priv_lvl_q;
...
debug_mode_q <= debug_mode_d;
...
However, it grants debug access and changes the privilege level, priv_lvl_o, even when one of
the two checks is satisfied and the other is not. Because of this, debug access can be granted
by simply requesting with sufficient privileges (i.e., debug_mode_q is enabled) and failing the
password check (i.e., umode_i is disabled). This allows an attacker to bypass the debug password
checking and gain debug access to the core, compromising the security of the processor.
A fix to this issue is to only change the privilege level of the processor when both checks are
satisfied, i.e., the request has enough privileges (i.e., debug_mode_q is enabled) and the password
checking is successful (i.e., umode_i is enabled) [REF-1378].
CWE Version 4.14
CWE-480: Use of Incorrect Operator
CWE-480: Use of Incorrect Operator