{"@ID": "1311", "@Name": "Improper Translation of Security Attributes by Fabric Bridge", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Draft", "Description": "The fabric bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.", "Extended_Description": {"xhtml:p": "A weakness can arise if the bridge IP block, which translates the signals from the protocol used in the IP block endpoint to the protocol used by the central bus, does not properly translate the security attributes.", "#text_blocks": ["A weakness can arise if the bridge IP block, which translates the signals from the protocol used in the IP block endpoint to the protocol used by the central bus, does not properly translate the security attributes."]}, "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "284", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": [{"Ordinality": "Primary"}, {"Ordinality": "Resultant"}]}, "Applicable_Platforms": {"Language": [{"@Name": "Verilog", "@Prevalence": "Undetermined"}, {"@Name": "VHDL", "@Prevalence": "Undetermined"}], "Technology": {"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}}, "Background_Details": {"Background_Detail": {"xhtml:p": ["A bridge allows IP blocks supporting different fabric protocols to be integrated into the system.  Fabric end-points or interfaces usually have dedicated signals to transport security attributes, such as HPROT signals in AHB, AxPROT signals in AXI, and MReqInfo and SRespInfo signals in OCP.", "The values on these signals are used to indicate the security attributes of the transaction. These include the immutable hardware identity of the controller initiating the transaction, privilege level, and type of transaction (e.g., read/write, cacheable/non-cacheable, posted/non-posted)."], "#text_blocks": ["A bridge allows IP blocks supporting different fabric protocols to be integrated into the system.  Fabric end-points or interfaces usually have dedicated signals to transport security attributes, such as HPROT signals in AHB, AxPROT signals in AXI, and MReqInfo and SRespInfo signals in OCP.", "The values on these signals are used to indicate the security attributes of the transaction. These include the immutable hardware identity of the controller initiating the transaction, privilege level, and type of transaction (e.g., read/write, cacheable/non-cacheable, posted/non-posted)."]}}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Architecture and Design"}, {"Phase": "Implementation"}]}, "Common_Consequences": {"Consequence": {"Scope": ["Confidentiality", "Integrity", "Access Control"], "Impact": ["Modify Memory", "Read Memory", "Gain Privileges or Assume Identity", "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands"], "Note": "The identity of the initiator could be translated from untrusted to trusted or vice-versa. This could result in access-control bypass, privilege escalation, or denial of service."}}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Architecture and Design", "Description": "The translation must map signals in such a way that untrusted agents cannot map to trusted agents or vice-versa."}, {"Phase": "Implementation", "Description": "Ensure that the translation maps signals in such a way that untrusted agents cannot map to trusted agents or vice-versa."}]}, "Demonstrative_Examples": {"Demonstrative_Example": {"Intro_Text": {"xhtml:p": ["The bridge interfaces between OCP and AHB end points. OCP uses MReqInfo signal to indicate security attributes, whereas AHB uses HPROT signal to indicate the security attributes. The width of MReqInfo can be customized as needed. In this example, MReqInfo is 5-bits wide and carries the privilege level of the OCP controller.", "The values 5'h11, 5'h10, 5'h0F, 5'h0D, 5'h0C, 5'h0B, 5'h09, 5'h08, 5'h04, and 5'h02 in MReqInfo indicate that the request is coming from a privileged state of the OCP bus controller. Values 5'h1F, 5'h0E, and 5'h00 indicate untrusted, privilege state.", "Though HPROT is a 5-bit signal, we only consider the lower, two bits in this example. HPROT values 2'b00 and 2'b10 are considered trusted, and 2'b01 and 2'b11 are considered untrusted.", "The OCP2AHB bridge is expected to translate trusted identities on the controller side to trusted identities on the responder side.  Similarly, it is expected to translate untrusted identities on the controller side to untrusted identities on the responder side."], "#text_blocks": ["The bridge interfaces between OCP and AHB end points. OCP uses MReqInfo signal to indicate security attributes, whereas AHB uses HPROT signal to indicate the security attributes. The width of MReqInfo can be customized as needed. In this example, MReqInfo is 5-bits wide and carries the privilege level of the OCP controller.", "The values 5'h11, 5'h10, 5'h0F, 5'h0D, 5'h0C, 5'h0B, 5'h09, 5'h08, 5'h04, and 5'h02 in MReqInfo indicate that the request is coming from a privileged state of the OCP bus controller. Values 5'h1F, 5'h0E, and 5'h00 indicate untrusted, privilege state.", "Though HPROT is a 5-bit signal, we only consider the lower, two bits in this example. HPROT values 2'b00 and 2'b10 are considered trusted, and 2'b01 and 2'b11 are considered untrusted.", "The OCP2AHB bridge is expected to translate trusted identities on the controller side to trusted identities on the responder side.  Similarly, it is expected to translate untrusted identities on the controller side to untrusted identities on the responder side."]}, "Example_Code": {"@Nature": "Bad", "@Language": "Verilog", "xhtml:br": [null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null], "#text": "ahb_hprot, \n\t        ocp_mreqinfo"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null, null, null], "#text": "000: ahb_hprot = 2'b11;    // OCP MReqInfo to AHB HPROT mapping\n\t          001: ahb_hprot = 2'b00;\n\t          010: ahb_hprot = 2'b00;\n\t          011: ahb_hprot = 2'b01;\n\t          100: ahb_hprot = 2'b00;\n\t          101: ahb_hprot = 2'b00;\n\t          110: ahb_hprot = 2'b10;\n\t          111: ahb_hprot = 2'b00;"}, "#text": "case (p0_mreqinfo_o_temp[4:2])\n\t\t\n\t        endcase"}], "#text": "module ocp2ahb\n\t      ( \n\t      \n\t      ); \n\t      \n\t      output [1:0] ahb_hprot;        // output is 2 bit signal for AHB HPROT\n\t      input [4:0] ocp_mreqinfo;      // input is 5 bit signal from OCP MReqInfo\n\t      wire [6:0] p0_mreqinfo_o_temp; // OCP signal that transmits hardware identity of bus controller\n\t       \n\t      wire y;\n\t      \n\t      reg [1:0] ahb_hprot;\n\t      \n\t      // hardware identity of bus controller is in bits 5:1 of p0_mreqinfo_o_temp signal\n\t      assign p0_mreqinfo_o_temp[6:0] = {1'b0, ocp_mreqinfo[4:0], y};\n\t      \n\t      always @*\n\t      begin\n\t      \n\t      end\n\t      endmodule", "#text_blocks": ["module ocp2ahb", "(", "ahb_hprot,", "ocp_mreqinfo", ");", "output [1:0] ahb_hprot;        // output is 2 bit signal for AHB HPROT", "input [4:0] ocp_mreqinfo;      // input is 5 bit signal from OCP MReqInfo", "wire [6:0] p0_mreqinfo_o_temp; // OCP signal that transmits hardware identity of bus controller", "wire y;", "reg [1:0] ahb_hprot;", "// hardware identity of bus controller is in bits 5:1 of p0_mreqinfo_o_temp signal", "assign p0_mreqinfo_o_temp[6:0] = {1'b0, ocp_mreqinfo[4:0], y};", "always @*", "begin", "case (p0_mreqinfo_o_temp[4:2])", "000: ahb_hprot = 2'b11;    // OCP MReqInfo to AHB HPROT mapping", "001: ahb_hprot = 2'b00;", "010: ahb_hprot = 2'b00;", "011: ahb_hprot = 2'b01;", "100: ahb_hprot = 2'b00;", "101: ahb_hprot = 2'b00;", "110: ahb_hprot = 2'b10;", "111: ahb_hprot = 2'b00;", "endcase", "end", "endmodule"]}, "Body_Text": "Logic in the case statement only checks for MReqInfo bits 4:2, i.e., hardware-identity bits 3:1. When ocp_mreqinfo is 5'h1F or 5'h0E, p0_mreqinfo_o_temp[2] will be 1. As a result, untrusted IDs from OCP 5'h1F and 5'h0E get translated to trusted ahb_hprot values 2'b00."}}, "Related_Attack_Patterns": {"Related_Attack_Pattern": [{"@CAPEC_ID": "1"}, {"@CAPEC_ID": "180"}, {"@CAPEC_ID": "233"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "Arun Kanuparthi, Hareesh Khattri, Parbati Manna", "Submission_Organization": "Intel Corporation", "Submission_Date": "2020-05-24", "Submission_Version": "4.3", "Submission_ReleaseDate": "2020-12-10"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-10-13", "Modification_Version": "4.9", "Modification_ReleaseDate": "2022-10-13", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Background_Details, Common_Consequences, Description"}], "Contribution": {"@Type": "Feedback", "Contribution_Name": "Hareesh Khattri", "Contribution_Organization": "Intel Corporation", "Contribution_Date": "2022-04-28", "Contribution_Version": "4.9", "Contribution_ReleaseDate": "2022-10-13", "Contribution_Comment": "Corrections in the demonstrative example."}}, "entry_type": "Weakness"}