CWE-1302 is about a transaction that leaves the source without a security identifier, in a system that depends on that identifier to decide what is allowed.
How it happens
On a System-On-Chip, hardware engines send transactions to access assets or perform actions such as reset, fetch or compute. A transaction has a source identity, a destination identity and more. Sometimes it is qualified with a Security Identifier, which helps the destination agent decide on allowed or disallowed actions.
The weakness appears when the source agent does not consistently include the identifier. MITRE describes two outcomes. The destination might drop the message, causing an inadvertent denial of service. Or it might take an inappropriate action by default while trying to execute the transaction, giving privilege escalation or unintended access.
What an attacker gains
Consequences listed with high likelihood: reading and modifying memory, a crash, exit or restart, bypassing protection mechanisms, and executing unauthorized code or commands.
How to find it
The record lists no detection methods. A sensible check is to drive every agent through every transaction type and confirm the identifier is present each time. Then test what each destination does when the identifier is absent. A safe default is deny.
How to fix it
MITRE asks for two things. Review transaction details for design inconsistency and common weaknesses in architecture and design. Test the security identifier definition and programming flow in pre-silicon and post-silicon testing.
Quick check
What are the two bad outcomes of a missing identifier?
Either the message is dropped, causing denial of service, or the destination acts by default and grants unintended access.
