CWE-1314 covers a subtle hole in chip protection. The device does not write-protect the parametric data values of sensors that scale the sensor value. Untrusted software can then manipulate the apparent result, which can damage hardware or cause operational failure.
How it happens
Hardware uses sensors to notice when a device operates outside its design limits. The limits relate to thermal, power, voltage, current and frequency. Threshold values are set by hardware fuses or by trusted software such as the BIOS, and hardware often protects those limits against changes by untrusted software.
Here is the catch MITRE describes. A sensor block may report in different units depending on its design. The raw output is converted to the desired units using a scale conversion based on parametric data programmed into the sensor. The converted value is then compared with the limit.
The limit is protected. The parametric data often is not. If untrusted software can change it, the converted number no longer reflects reality, and safe operational limits can be bypassed without touching the limit itself.
What an attacker gains
MITRE rates the likelihood as high. The affected scope is availability, with quality degradation and resource consumption listed. The note in the record is direct: manipulating a sensor value, particularly thermal or power, may allow physical damage, or may disable the device through a false fault shutdown, which is a denial of service.
The attack works in both directions. Make a hot chip read cool and the protection never fires. Make a cool chip read hot and it shuts down.
The record lists an observed example, CVE-2017-8252: the kernel can inject faults in computations during the execution of TrustZone, leading to information disclosure in a long list of Snapdragon product lines.
How to find it
No detection methods are listed. A useful review asks three questions:
- Which registers hold sensor scale or calibration data, not only thresholds?
- Who can write to each, in each privilege mode?
- If an untrusted agent changes the value, what does the protection logic then conclude?
Run the write test from an untrusted privilege level and confirm it fails.
How to fix it
MITRE rates its mitigation as high effectiveness. In architecture and design, make access controls for sensor blocks ensure that only trusted software is allowed to change threshold limits and sensor parametric data.
The key phrase is and sensor parametric data. Protect the whole chain from raw reading to comparison, not just the final threshold.
Quick check
Why is protecting only the threshold not enough?
The reading is scaled using parametric data before it is compared to the threshold. Changing the scale changes the outcome without touching the threshold.
What can go wrong if thermal data is faked?
Hardware may be physically damaged, or the device may be shut down by a false fault, causing denial of service.
