Weakness · High
CWE-1326: Missing Immutable Root of Trust in Hardware
What it is
A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
A System-on-Chip (SoC) implements secure boot by verifying or authenticating signed boot code. The signing of the code is achieved by an entity that the SoC trusts. Before executing the boot code, the SoC verifies that the code or the public key with which the code has been signed has not been tampered with. The other data upon which the SoC depends are system-hardware settings in fuses such as whether "Secure Boot is enabled". These data play a crucial role in establishing a Root of Trust (RoT) to execute secure-boot flows. One of the many ways RoT is achieved is by storing the code and data in memory or fuses. This memory should be immutable, i.e., once the RoT is programmed/provisioned in memory, that memory should be locked and prevented from further programming or writes. If the memory contents (i.e., RoT) are mutable, then an adversary can modify the RoT to execute their choice of code, resulting in a compromised secure boot. Note that, for components like ROM, secure patching/update features should be supported to allow authenticated and authorized updates in the field.
What an attacker can do
- Gain Privileges or Assume Identity (Authentication, Authorization)
- Execute Unauthorized Code or Commands (Authentication, Authorization)
- Modify Memory (Authentication, Authorization)
How to prevent it
Architecture and Design
- When architecting the system, the RoT should be designated for storage in a memory that does not allow further programming/writes.
Implementation
- During implementation and test, the RoT memory location should be demonstrated to not allow further programming/writes.
How to find it
- Automated Dynamic Analysis. Automated testing can verify that RoT components are immutable.
- Architecture or Design Review. Root of trust elements and memory should be part of architecture and design reviews.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.