CWE-1302
Weakness AllowedMissing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
Abstraction: Base · Status: Incomplete
The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity, but the entity does not consistently include the necessary Security Identifier with a security-critical transaction.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Such issues could be introduced during hardware architecture and design and identified later during Testing or System Configuration phases.
Such issues could be introduced during implementation and identified later during Testing or System Configuration phases.
Content history
updated Related_Attack_Patterns
updated Demonstrative_Examples, Relationships
updated Related_Attack_Patterns
updated Demonstrative_Examples
updated Relationships
updated Mapping_Notes
updated Description, Name
updated Demonstrative_Examples, Weakness_Ordinalities
updated Background_Details, Common_Consequences, Description
0 vulnerabilities reference this CWE, most recent first.
No vulnerabilities reference this CWE.
Mitigation
Transaction details must be reviewed for design inconsistency and common weaknesses.
Mitigation
Security identifier definition and programming flow must be tested in pre-silicon and post-silicon testing.
CAPEC-121: Exploit Non-Production Interfaces
An adversary exploits a sample, demonstration, test, or debug interface that is unintentionally enabled on a production system, with the goal of gleaning information or leveraging functionality that would otherwise be unavailable.
CAPEC-681: Exploitation of Improperly Controlled Hardware Security Identifiers
An adversary takes advantage of missing or incorrectly configured security identifiers (e.g., tokens), which are used for access control within a System-on-Chip (SoC), to read/write data or execute a given action.