Détail du CWE-1298

CWE-1298

Hardware Logic Contains Race Conditions
Draft
2020-08-20
00h00 +00:00
2024-02-29
00h00 +00:00
Notifications pour un CWE
Restez informé de toutes modifications pour un CWE spécifique.
Gestion des notifications

Nom: Hardware Logic Contains Race Conditions

A race condition in the hardware logic results in undermining security guarantees of the system.

Description du CWE

A race condition in logic circuits typically occurs when a logic gate gets inputs from signals that have traversed different paths while originating from the same source. Such inputs to the gate can change at slightly different times in response to a change in the source signal. This results in a timing error or a glitch (temporary or permanent) that causes the output to change to an unwanted state before settling back to the desired state. If such timing errors occur in access control logic or finite state machines that are implemented in security sensitive flows, an attacker might exploit them to circumvent existing protections.

Informations générales

Modes d'introduction

Architecture and Design
Implementation

Plateformes applicables

Langue

Name: Verilog (Undetermined)
Name: VHDL (Undetermined)

Technologies

Class: System on Chip (Undetermined)

Conséquences courantes

Portée Impact Probabilité
Access ControlBypass Protection Mechanism, Gain Privileges or Assume Identity, Alter Execution Logic

Mesures d’atténuation potentielles

Phases : Architecture and Design
Adopting design practices that encourage designers to recognize and eliminate race conditions, such as Karnaugh maps, could result in the decrease in occurrences of race conditions.
Phases : Implementation
Logic redundancy can be implemented along security critical paths to prevent race conditions. To avoid metastability, it is a good practice in general to default to a secure state in which access is not given to untrusted agents.

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Modèles d'attaque associés

CAPEC-ID Nom du modèle d'attaque
CAPEC-26 Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.

Références

REF-1115

FPGA designs with Verilog (section 7.4 Glitches)
Meher Krishna Patel.
https://verilogguide.readthedocs.io/en/latest/verilog/fsm.html

REF-1116

Non-Blocking Assignments in Verilog Synthesis, Coding Styles that Kill!
Clifford E. Cummings.
http://www.sunburst-design.com/papers/CummingsSNUG2000SJ_NBA.pdf

REF-1394

dma.sv
https://github.com/HACK-EVENT/hackatdac21/blob/main/piton/design/chip/tile/ariane/src/dma/dma.sv

REF-1395

Fix for dma.sv
https://github.com/HACK-EVENT/hackatdac21/blob/cwe_1298_in_dma/piton/design/chip/tile/ariane/src/dma/dma.sv

Soumission

Nom Organisation Date Date de publication Version
Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi Intel Corporation 2020-02-10 +00:00 2020-08-20 +00:00 4.2

Modifications

Nom Organisation Date Commentaire
CWE Content Team MITRE 2021-07-20 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2024-02-29 +00:00 updated Demonstrative_Examples, References