CWE-1245 is the weakness of a faulty finite state machine (FSM) in hardware logic. The flaw lets an attacker push the system into an undefined state, which can mean a denial of service or a gain in privileges. Hardware designers and verification engineers are the main audience.
How it happens
Hardware often uses FSMs to track the current security state of the system. Secure data operations and data transfers rely on the state the FSM reports. If the FSM misses cases, the state it reports can stop meaning anything.
MITRE says the faulty designs are those that do not account for all states, either by leaving undefined states as don't cares or by implementing them wrongly.
The standard example is a Verilog module where the next state depends on a user-supplied input. The case statement handles inputs 0 through 5. Inputs 6 and 7 are legal values for a 3-bit signal but have no branch, so they drive the machine into an undefined state.
// Vulnerable: no default branch, inputs 6 and 7 are unhandled
case (user_input)
3'h3: state = 2'h3;
3'h4: state = 2'h2;
3'h5: state = 2'h1;
endcase
What an attacker gains
MITRE lists availability and access control as the affected areas. The attacker can cause a crash, exit or restart, cause instability, or gain privileges or assume identity. When the FSM encodes a security state, landing in an undefined state may land in a more permissive one.
How to find it
The record has no detection methods. The cause is concrete enough to review directly.
- For each FSM, list the encoded states and the legal input values.
- Check that every combination reaches a defined branch.
- Look for case statements without a default, and for states with no defined exit.
- In simulation, drive every input value, including the ones the specification says should never occur.
How to fix it
MITRE's advice for design and implementation: define all possible states, handle every unused state through default statements, and make sure the system defaults to a secure state. Effectiveness is rated high.
// Fix: every input is handled, and the fallback is a safe state
case (user_input)
3'h3: state = 2'h3;
3'h4: state = 2'h2;
3'h5: state = 2'h1;
default: state = 2'h0;
endcase
The detail that matters is the choice of default. A default that falls into a permissive state only changes the bug, not the risk.
Quick check
Why is a missing default branch a security issue and not just a bug?
Because FSMs often encode the security state of the system. An attacker who can force an undefined state may cause a crash or end up with more privilege than intended.
What should the default state be?
A secure one. MITRE says to ensure the system defaults to a secure state.
