CWE-1318 is a design weakness: on-chip fabrics or buses either do not support, or are not configured to support, privilege separation or other security features such as access control.
How it happens
Some on-chip fabrics and buses, especially simple and low-power ones, have no interfaces to transfer privilege, immutable identity or any other security attribute from the bus master. They also lack dedicated signals for security-sensitive data going back from slave to master, such as completions for certain transactions.
Other fabrics support security features and define specific signals for them. But MITRE notes including those signals is not mandatory, and they can be left unconfigured when the register-transfer-level (RTL) description of the fabric is generated. A bus that could have been secure ends up not being so.
If a peripheral holding a security asset sits behind such a bus, the peripheral has no way to know who is asking.
What an attacker gains
MITRE rates the likelihood as medium. Consequences: reading memory, modifying memory, crash or restart, with confidentiality, integrity, access control and availability affected.
How to find it
Two detection methods, both rated high:
- Architecture or design review: review the fabric specification and ensure it contains signals to transfer security-sensitive information.
- Manual static analysis of source code: the lack of security features can also be confirmed through manual RTL review of the fabric.
A short checklist for the review:
- List every fabric and bus in the SoC.
- For each, mark whether security attribute signals exist and whether they are configured in the generated RTL.
- List the peripherals attached to each and mark which ones hold security assets.
- Flag any asset-holding peripheral that sits behind a fabric lacking the signals.
How to fix it
MITRE gives two options at the architecture and design stage.
- If the fabric does not support security features, implement security checks in a bridge or any component between the master and the fabric.
- Alternatively, connect all fabric slaves that hold no security assets to one fabric, and connect peripherals with security assets to a different fabric that does support security features.
MITRE also states a general rule. Fabrics without these features should not be used to transport any security attribute coming from the bus master, and peripherals with security assets should not be connected to such buses before the master's transaction reaches the bus, unless some form of access control is performed at a fabric bridge or another intermediate module.
Quick check
Can a secure-capable fabric still be insecure?
Yes. The security signals are optional and can be left unconfigured when the RTL is generated.
What is the split-fabric option?
Put peripherals without security assets on one fabric and peripherals with assets on a different fabric that supports security features.
