Weakness · High
CWE-1317: Improper Access Control in Fabric Bridge
What it is
The product uses a fabric bridge for transactions between two Intellectual Property (IP) blocks, but the bridge does not properly perform the expected privilege, identity, or other access control checks between those IP blocks.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
In hardware designs, different IP blocks are connected through interconnect-bus fabrics (e.g. AHB and OCP). Within a System on Chip (SoC), the IP block subsystems could be using different bus protocols. In such a case, the IP blocks are then linked to the central bus (and to other IP blocks) through a fabric bridge. Bridges are used as bus-interconnect-routing modules that link different protocols or separate, different segments of the overall SoC interconnect. For overall system security, it is important that the access-control privileges associated with any fabric transaction are consistently maintained and applied, even when they are routed or translated by a fabric bridge. A bridge that is connected to a fabric without security features forwards transactions to the slave without checking the privilege level of the master and results in a weakness in SoC access-control security. The same weakness occurs if a bridge does not check the hardware identity of the transaction received from the slave interface of the bridge.
What an attacker can do
- DoS: Crash, Exit, or Restart (Confidentiality, Integrity, Access Control, Availability)
- Bypass Protection Mechanism (Confidentiality, Integrity, Access Control, Availability)
- Read Memory (Confidentiality, Integrity, Access Control, Availability)
- Modify Memory (Confidentiality, Integrity, Access Control, Availability)
How to prevent it
Architecture and Design
- Ensure that the design includes provisions for access-control checks in the bridge for both upstream and downstream transactions.
Implementation
- Implement access-control checks in the bridge for both upstream and downstream transactions.
How to find it
- Simulation / Emulation. RTL simulation to ensure that bridge-access controls are implemented properly.
- Formal Verification. Formal verification of bridge RTL to ensure that access control cannot be bypassed.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.