Few fabrics mirror memory and address ranges, where mirrored regions contain copies of the original data. This redundancy is used to achieve fault tolerance. Whatever protections the fabric firewall implements for the original region should also apply to the mirrored regions. If not, an attacker could bypass existing read/write protections by reading from/writing to the mirrored regions to leak or corrupt the original data.
| Impact | Details |
|---|---|
|
Modify Memory; Read Memory; Bypass Protection Mechanism |
Scope: Confidentiality, Integrity, Access Control |
| Phase(s) | Mitigation |
|---|---|
|
Architecture and Design |
The fabric firewall should apply the same protections as the original region to the mirrored regions.
|
|
Implementation |
The fabric firewall should apply the same protections as the original region to the mirrored regions.
|
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | Pillar Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 284 | Improper Access Control |
| Nature | Type | ID | Name |
|---|---|---|---|
| MemberOf | Category Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1203 | Peripherals, On-chip Fabric, and Interface/IO Problems |
| PeerOf | Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1251 | Mirrored Regions with Different Values |
| Phase | Note |
|---|---|
| Architecture and Design | |
| Implementation |
Class: Not Language-Specific (Undetermined Prevalence)
Class: Not OS-Specific (Undetermined Prevalence)
Class: Not Architecture-Specific (Undetermined Prevalence)
Class: Not Technology-Specific (Undetermined Prevalence)
Example 1
A memory-controller IP block is connected to the on-chip fabric in a System on Chip (SoC). The memory controller is configured to divide the memory into four parts: one original and three mirrored regions inside the memory. The upper two bits of the address indicate which region is being addressed. 00 indicates the original region and 01, 10, and 11 are used to address the mirrored regions. All four regions operate in a lock-step manner and are always synchronized. The firewall in the on-chip fabric is programmed to protect the assets in the memory.
The firewall only protects the original range but not the mirrored regions.
The attacker (as an unprivileged user) sends a write transaction to the mirrored region. The mirrored region has an address with the upper two bits set to "10" and the remaining bits of the address pointing to an asset. The firewall does not block this write transaction. Once the write is successful, contents in the protected-memory region are also updated. Thus, the attacker can bypass existing, memory protections.
Firewall should protect mirrored regions.
| Method | Details |
|---|---|
|
Manual Dynamic Analysis |
Using an external debugger, send write transactions to mirrored regions to test if original, write-protected regions are modified. Similarly, send read transactions to mirrored regions to test if the original, read-protected signals can be read.
Effectiveness: High |
| Nature | Type | ID | Name |
|---|---|---|---|
| MemberOf | CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. | 1396 | Comprehensive Categorization: Access Control |
Rationale
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Comments
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.| Submissions | ||
|---|---|---|
| Submission Date | Submitter | Organization |
|
2020年06月01日
(CWE 4.3, 2020年12月10日) |
Arun Kanuparthi, Hareesh Khattri, Parbati K. Manna | Intel Corporation |
| Modifications | ||
| Modification Date | Modifier | Organization |
| 2023年06月29日 | CWE Content Team | MITRE |
| updated Mapping_Notes | ||
| 2023年04月27日 | CWE Content Team | MITRE |
| updated Relationships | ||
| 2023年01月31日 | CWE Content Team | MITRE |
| updated Related_Attack_Patterns | ||
| 2022年04月28日 | CWE Content Team | MITRE |
| updated Related_Attack_Patterns | ||
| 2021年10月28日 | CWE Content Team | MITRE |
| updated Potential_Mitigations | ||
Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2025, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.