{"@ID": "1193", "@Name": "Power-On of Untrusted Execution Core Before Enabling Fabric Access Control", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Draft", "Description": "The product enables components that contain untrusted firmware before memory and fabric access controls have been enabled.", "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "696", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "System on Chip", "@Prevalence": "Undetermined"}}, "Background_Details": {"Background_Detail": "After initial reset, System-on-Chip (SoC) fabric access controls and other\n           security features need to be programmed by trusted firmware as part\n           of the boot sequence."}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Architecture and Design"}}, "Common_Consequences": {"Consequence": {"Scope": "Access Control", "Impact": "Bypass Protection Mechanism", "Likelihood": "High", "Note": "If untrusted IPs or peripheral microcontrollers\n\t   are enabled too soon, then the untrusted component can master\n           transactions on the hardware bus and target memory or other assets to\n           compromise the SoC boot firmware."}}, "Potential_Mitigations": {"Mitigation": {"Phase": "Architecture and Design", "Description": {"xhtml:p": "The boot sequence should enable fabric access controls and memory protections before enabling third-party hardware IPs and peripheral microcontrollers that use untrusted firmware.", "#text_blocks": ["The boot sequence should enable fabric access controls and memory protections before enabling third-party hardware IPs and peripheral microcontrollers that use untrusted firmware."]}}}, "Related_Attack_Patterns": {"Related_Attack_Pattern": [{"@CAPEC_ID": "1"}, {"@CAPEC_ID": "180"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-1130"}, {"@External_Reference_ID": "REF-1042"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi", "Submission_Organization": "Intel Corporation", "Submission_Date": "2019-10-15", "Submission_Version": "4.0", "Submission_ReleaseDate": "2020-02-24"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-08-20", "Modification_Version": "4.2", "Modification_ReleaseDate": "2020-08-20", "Modification_Comment": "updated References, Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Applicable_Platforms, Time_of_Introduction, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Background_Details, Common_Consequences, Description"}]}, "entry_type": "Weakness"}