Weakness · High
CWE-1311: Improper Translation of Security Attributes by Fabric Bridge
What it is
The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
A bridge allows IP blocks supporting different fabric protocols to be integrated into the system. Fabric end-points or interfaces usually have dedicated signals to transport security attributes. For example, HPROT signals in AHB, AxPROT signals in AXI, and MReqInfo and SRespInfo signals in OCP. The values on these signals are used to indicate the security attributes of the transaction. These include the immutable hardware identity of the controller initiating the transaction, privilege level, and type of transaction (e.g., read/write, cacheable/non-cacheable, posted/non-posted). A weakness can arise if the bridge IP block, which translates the signals from the protocol used in the IP block endpoint to the protocol used by the central bus, does not properly translate the security attributes. As a result, the identity of the initiator could be translated from untrusted to trusted or vice-versa. This could result in access-control bypass, privilege escalation, or denial of service.
What an attacker can do
- Modify Memory (Confidentiality, Integrity, Access Control)
- Read Memory (Confidentiality, Integrity, Access Control)
- Gain Privileges or Assume Identity (Confidentiality, Integrity, Access Control)
- Bypass Protection Mechanism (Confidentiality, Integrity, Access Control)
- Execute Unauthorized Code or Commands (Confidentiality, Integrity, Access Control)
How to prevent it
Architecture and Design
- The translation must map signals in such a way that untrusted agents cannot map to trusted agents or vice-versa.
Implementation
- Ensure that the translation maps signals in such a way that untrusted agents cannot map to trusted agents or vice-versa.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.