CWE-1310—Missing Ability to Patch ROM Code

Weakness Name

Missing Ability to Patch ROM Code

Description

Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state.

A System or System-on-Chip (SoC) that implements a boot process utilizing security mechanisms such as Root-of-Trust (RoT) typically starts by executing code from a Read-only-Memory (ROM) component. The code in ROM is immutable, hence any security vulnerabilities discovered in the ROM code can never be fixed for the systems that are already in use. A common weakness is that the ROM does not have the ability to patch if security vulnerabilities are uncovered after the system gets shipped. This leaves the system in a vulnerable state where an adversary can compromise the SoC.

Common Consequences

Scope:

Other

Impact:

Varies by Context, Reduce Maintainability

Notes:

When the system is unable to be patched, it can be left in a vulnerable state.

Related Weaknesses

• CWE-1329Reliance on Component That is Not Updateable