CWE-1304—Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation

名称

Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation

描述

The product performs a power save/restore operation, but it does not ensure that the integrity of the configuration state is maintained and/or verified between the beginning and ending of the operation.

Before powering down, the Intellectual Property (IP) saves current state (S) to persistent storage such as flash or always-on memory in order to optimize the restore operation. During this process, an attacker with access to the persistent storage may alter (S) to a configuration that could potentially modify privileges, disable protections, and/or cause damage to the hardware. If the IP does not validate the configuration state stored in persistent memory, upon regaining power or becoming operational again, the IP could be compromised through the activation of an unwanted/harmful configuration.

常见后果

范围：

Confidentiality, Integrity

影响：

DoS: Instability, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (Other), Gain Privileges or Assume Identity, Bypass Protection Mechanism, Alter Execution Logic, Quality Degradation, Unexpected State, Reduce Maintainability, Reduce Performance, Reduce Reliability

相关 CWE

• CWE-284Improper Access Control
• CWE-345Insufficient Verification of Data Authenticity
• CWE-1271Uninitialized Value on Reset for Registers Holding Security Settings