Book a Security Review

Weakness · Medium

CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy

What it is

An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode.

MITRE CWE 4.19.1

Severity (our rating)
Medium
Likelihood of exploit
Not rated by MITRE
Introduced during
Architecture and Design, Implementation, Integration
Exploited in the wild
No CVE in CISA's catalog

In more detail

To ensure the performance and functional reliability of certain components, hardware designers can implement hardware blocks for redundancy in the case that others fail. This redundant block can be prevented from performing as intended if the design allows unauthorized agents to inject errors into it. In this way, a path with injected errors may become unavailable to serve as a redundant channel. This may put the system into a degraded mode of operation which could be exploited by a subsequent attack.

What an attacker can do

  • DoS: Crash, Exit, or Restart (Integrity, Availability)
  • DoS: Instability (Integrity, Availability)
  • Quality Degradation (Integrity, Availability)
  • DoS: Resource Consumption (CPU) (Integrity, Availability)
  • DoS: Resource Consumption (Memory) (Integrity, Availability)
  • DoS: Resource Consumption (Other) (Integrity, Availability)
  • Reduce Performance (Integrity, Availability)
  • Reduce Reliability (Integrity, Availability)
  • Unexpected State (Integrity, Availability)

How to prevent it

Architecture and Design

  • Ensure the design does not allow error injection in modes intended for normal run-time operation. Provide access controls on interfaces for injecting errors.

Implementation

  • Disallow error injection in modes which are expected to be used for normal run-time operation. Provide access controls on interfaces for injecting errors.

Integration

  • Add an access control layer atop any unprotected interfaces for injecting errors.

CWE-1334 on MITRE's CWE site

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.