CWE-1315 is a configuration weakness in an on-chip fabric. The bus controller enables bits in the fabric end-point that let responder devices control transactions on the fabric.
How it happens
For reuse, some fabric interfaces provide a configurable register bit that lets IP blocks connected to the controller access other peripherals on the fabric. That lets one end point serve a device that acts as a controller or as a responder.
If the bit is set by default in hardware, or firmware sets it later by mistake, a device meant to be a responder can now control transactions to other devices. That may compromise system security.
What an attacker gains
MITRE lists access control and protection mechanism bypass, plus the ability to read and modify memory.
How to find it
No detection methods are listed. Check the reset value of the bus-controlling bit for every responder end point. Then read the register after each stage of boot, including secure boot, and confirm it is still zero. Finally, test whether untrusted software can write to it.
How to fix it
MITRE gives the same guidance for design, implementation and system configuration:
- For responder devices, set the controlling bit to 0 by default.
- Do not set it during secure-boot flows.
- Access-protect writes to the register so it cannot be changed maliciously.
Quick check
Who might set the bit by mistake?
Hardware defaults can have it on, and firmware can set it incorrectly later.
