CWE-1189: Improper Isolation of Shared Resources on… | Glexia
CWE-1189 (Improper Isolation of Shared Resources on System-on-a-Chip (SoC)) weakness overview with consequences, detection methods, mitigations, related CVEs and…
Glexia's Take · Automated analysis
CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
Improper Isolation of Shared Resources on System-on-a-Chip (SoC) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Access Control: Bypass Protection Mechanism: If resources being used by a trusted user are shared with an untrusted user, the untrusted user may be able to modify the functionality of the shared resource of the trusted user.
- Integrity: Quality Degradation: The functionality of the shared resource may be intentionally degraded.
Developer Pattern
CWE-1189 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Automation confidence
high confidence from CWE-1189, 4.20.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Official CWE Definition
CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents.
A System-On-a-Chip (SoC) has a lot of functionality, but it may have a limited number of pins or pads. A pin can only perform one function at a time. However, it can be configured to perform multiple different functions. This technique is called pin multiplexing. Similarly, several resources on the chip may be shared to multiplex and support different features or functions. When such resources are shared between trusted and untrusted agents, untrusted agents may be able to access the assets intended to be accessed only by the trusted agents.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- Consider the following SoC design. The Hardware Root of Trust (HRoT) local SRAM is memory mapped in the core{0-N} address space. The HRoT allows or disallows access to private memory ranges, thus allowing the sram to function as a mailbox for communication between untrusted and trusted HRoT partitions. We assume that the threat is from malicious software in the untrusted domain. We assume this software has access to the core{0-N} memory map and can be running at any privilege level on the untrusted cores. The capability of this threat in this example is communication to and from the mailbox region of SRAM modulated by the hrot_iface. To address this threat, information must not enter or exit the shared region of SRAM through hrot_iface when in secure or privileged mode. /data/images/HRoT-CWE.png Hardware Root of Trust
Remediation
- Architecture and Design: When sharing resources, avoid mixing agents of varying trust levels. Untrusted agents should not share resources with trusted agents.
Detection
- Automated Dynamic Analysis: Pre-silicon / post-silicon: Test access to shared systems resources (memory ranges, control registers, etc.) from untrusted software to verify that the assets are not incorrectly exposed to untrusted agents. Note that access to shared resources can be dynamically allowed or revoked based on system flows. Security testing should cover such dynamic shared resource allocation and access control modification flows.
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
- CWE-1331: Improper Isolation of Shared Resources in Network On Chip (NoC)
- CWE-653: Improper Isolation or Compartmentalization
- CWE-668: Exposure of Resource to Wrong Sphere
- CWE-1303: Non-Transparent Sharing of Microarchitectural Resources
- CWE-1331: Improper Isolation of Shared Resources in Network On Chip (NoC)
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.