CWE-1294 is a class-level weakness. It says a System-on-Chip (SoC) has a Security Identifier mechanism to tell allowed actions from disallowed ones, but the identifiers are not correctly implemented.
How it happens
Integrated circuits and hardware engines on an SoC send actions such as read, write, program, reset, fetch and compute. Security identifiers are generated and assigned to each agent that can send or receive an action. Each agent can get a unique identifier based on its trust level or privileges.
MITRE says a broad class of flaws can exist in this process. The list includes missing security identifiers, improper conversion of security identifiers, and incorrect generation of security identifiers, and it is not limited to those. Narrower weaknesses such as CWE-1290, CWE-1292 and CWE-1302 are specific cases.
What an attacker gains
High-likelihood consequences per MITRE: read and modify memory, execute unauthorized code or commands, gain privileges or assume identity, bypass access control, resource-consumption denial of service, and quality degradation.
How to find it
No detection methods are listed. Start with the full life of an identifier: where it is generated, how it is assigned, how it travels with a transaction, and where it is decoded or converted. Gaps at any step belong to this class.
How to fix it
Review the security identifier decoders for design inconsistency and common weaknesses during architecture and design. Then test access and programming flows in pre-silicon and post-silicon testing.
Quick check
Why is CWE-1294 called a class?
It is broad. Missing, converted and generated identifier flaws all fall under it, with more specific weaknesses beneath.
