CWE-1310—Missing Ability to Patch ROM Code

名称

Missing Ability to Patch ROM Code

描述

Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state.

A System or System-on-Chip (SoC) that implements a boot process utilizing security mechanisms such as Root-of-Trust (RoT) typically starts by executing code from a Read-only-Memory (ROM) component. The code in ROM is immutable, hence any security vulnerabilities discovered in the ROM code can never be fixed for the systems that are already in use. A common weakness is that the ROM does not have the ability to patch if security vulnerabilities are uncovered after the system gets shipped. This leaves the system in a vulnerable state where an adversary can compromise the SoC.

常见后果

范围：

Other

影响：

Varies by Context, Reduce Maintainability

注释：

When the system is unable to be patched, it can be left in a vulnerable state.

相关 CWE

• CWE-1329Reliance on Component That is Not Updateable