CWE-1298 describes a race condition in hardware logic that undermines the security guarantees of the system. It applies to designs written in Verilog or VHDL and to System-on-Chip designs.
How it happens
MITRE explains it at the gate level. A race condition in logic circuits usually occurs when a logic gate takes inputs from signals that travelled different paths but started at the same source. The inputs can change at slightly different times after a change in the source signal. That produces a timing error, a glitch that may be temporary or permanent. The output can flip to an unwanted state before it settles back to the intended one.
Most of the time this is harmless. It matters when the gate sits in access control logic or in a finite state machine that runs a security sensitive flow. A momentary wrong output there might be a momentary grant of access.
An attacker does not need to find a bug in code. They need to cause or time the conditions that produce the glitch, and then act during the window.
What an attacker gains
The record lists three consequences: bypass of a protection mechanism, gaining privileges or assuming identity, and altering execution logic. Access control is the affected scope.
How to find it
The record lists no detection methods. Reasonable checks follow from the description:
- Identify every security-critical gate or state machine whose inputs arrive over different paths from a shared source.
- Review the timing of those paths during design and after synthesis.
- Test behavior at the edges, where inputs change close together.
How to fix it
MITRE gives design-level and implementation-level steps.
At the architecture and design stage, adopt design practices that help designers recognize and eliminate race conditions. Karnaugh maps are the example given, and MITRE says such practices could decrease occurrences.
At implementation, add logic redundancy along security-critical paths to prevent race conditions. MITRE also says that to avoid metastability it is good practice to default to a secure state in which access is not given to untrusted agents. If the logic is unsure, the answer should be deny.
Quick check
Where do these races hurt most?
In access control logic and in finite state machines that run security sensitive flows.
What default state does MITRE recommend?
A secure state in which access is not given to untrusted agents.
