2129
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
Read Application Data
Potential Mitigations
Phase: Architecture and Design
Measurement data should be stored in registers that are read-only or otherwise have access
controls that prevent modification by an untrusted agent.
Demonstrative Examples
Example 1:
The SoC extends the hash and stores the results in registers. Without protection, an adversary can
write their chosen hash values to these registers. Thus, the attacker controls the reported results.
To prevent the above scenario, the registers should have one or more of the following properties:
• Should be Read-Only with respect to an adversary
• Cannot be extended or modifiable either directly or indirectly (using a trusted agent as proxy)
by an adversary
• Should have appropriate access controls or protections
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1196 Security Flow Issues 1194 2469
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
This entry is still in development and will continue to see updates and content improvements.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
680 Exploitation of Improperly Controlled Registers
References
CWE Version 4.14
CWE-1284: Improper Validation of Specified Quantity in Input
CWE-1284: Improper Validation of Specified Quantity in Input