2213
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 693 Protection Mechanism Failure 1520
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Security Hardware (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Authentication
Authorization
Gain Privileges or Assume Identity
Execute Unauthorized Code or Commands
Modify Memory
High
Detection Methods
Automated Dynamic Analysis
Automated testing can verify that RoT components are immutable.
Effectiveness = High
Architecture or Design Review
Root of trust elements and memory should be part of architecture and design reviews.
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
When architecting the system, the RoT should be designated for storage in a memory that does
not allow further programming/writes.
Phase: Implementation
During implementation and test, the RoT memory location should be demonstrated to not allow
further programming/writes.
Demonstrative Examples
Example 1:
The RoT is stored in memory. This memory can be modified by an adversary. For example, if an
SoC implements "Secure Boot" by storing the boot code in an off-chip/on-chip flash, the contents
of the flash can be modified by using a flash programmer. Similarly, if the boot code is stored
in ROM (Read-Only Memory) but the public key or the hash of the public key (used to enable
"Secure Boot") is stored in Flash or a memory that is susceptible to modifications or writes, the
implementation is vulnerable.
In general, if the boot code, key materials and data that enable "Secure Boot" are all mutable, the
implementation is vulnerable.
Good architecture defines RoT as immutable in hardware. One of the best ways to achieve
immutability is to store boot code, public key or hash of the public key and other relevant data
CWE Version 4.14
CWE-1326: Missing Immutable Root of Trust in Hardware
CWE-1326: Missing Immutable Root of Trust in Hardware