CWE-1276 describes signals between a hardware IP block and its parent system design that are connected incorrectly, creating security risk. The product keeps working, so nobody notices.
How it happens
Every IP block must communicate with the parent design to function. A wiring error may cause no visible functional problem and still cause a security one.
MITRE gives an example. An IP block should only be reset by a system wide hard reset, but its reset input is connected to a software triggered debug mode reset, which is also asserted during a hard reset. Everything seems fine in normal testing, yet software can now reset the block and violate the integrity of data inside it.
What an attacker gains
Consequences cover confidentiality, integrity and availability and vary by context. In the reset example, the damage is to the integrity of data held in the block.
How to find it
Functional tests will not catch this, since function is unaffected. Review integration connectivity for security sensitive signals such as resets, clocks and debug controls, and ask for each connection whether the source is the one the security design requires.
How to fix it
- List security sensitive signals for every IP block.
- State which parent signal each one must connect to.
- Check the integration against that list, in review and in verification.
Quick check
Why do normal tests miss it?
The block behaves correctly for expected operations. The flaw only shows when someone triggers the wrong source, such as a software debug reset.
