CWE-1312 describes an on-chip fabric firewall that protects the main addressed region but leaves mirrored memory or memory-mapped IO (MMIO) regions open.
How it happens
Some fabrics mirror memory and address ranges. A mirrored region holds a copy of the original data, which gives fault tolerance. The protections applied to the original should apply to every mirror too. If they do not, an attacker can read or write the mirror to leak or corrupt the original data, bypassing the read and write protections.
The same shape shows up everywhere: a check on the front door, an unlocked side door.
What an attacker gains
MITRE lists reading and modifying memory, access control bypass and protection mechanism bypass, with confidentiality and integrity impact.
How to find it
MITRE gives a manual dynamic analysis: use an external debugger to send write transactions to mirrored regions and check whether the original, write-protected regions get modified. Add the matching read test for confidential regions.
How to fix it
In both architecture and implementation, the fabric firewall should apply the same protections to the mirrored regions as to the original region. Keep a list of every alias for each protected region so none is missed when the address map changes.
Quick check
Why do fabrics mirror regions at all?
For redundancy and fault tolerance. The mirrored copy holds the same data as the original.
