Description
The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers.
Potential Impact
- Confidentiality: Read Memory
How to Fix
Architecture and Design
Design proper policies for hardware register access from software.
Implementation
Ensure that access control policies for register access are implemented in accordance with the specified design.
Detection Methods
- Manual Analysis: This is applicable in the Architecture phase before implementation started. Make sure access policy is specified for the entire memory map. Manual analysis may not ensure the implementation is correct...
- Manual Analysis: Registers controlling hardware should have access control implemented. This access control may be checked manually for correct implementation. Items to check consist of how are trusted parties set, ho...
- Simulation / Emulation: Functional simulation is applicable during the Implementation Phase. Testcases must be created and executed for memory mapped registers to verify adherence to the access control policy. This method ca...
Related Weaknesses
References
View on MITRE CWE Database →
