目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-1221 类漏洞列表 2

CWE-1221 类弱点 2 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1221 属于硬件描述语言中的配置错误漏洞，指寄存器默认值或硬件 IP 参数被错误定义为不安全状态。攻击者可利用此缺陷，在硬件复位后通过操纵寄存器内容，绕过安全控制或获取未授权访问权限。开发者应严格审查硬件描述代码，确保所有关键寄存器在复位时初始化为经过验证的安全默认值，并实施严格的参数校验机制，以消除潜在的安全隐患。

MITRE CWE 官方描述
CWE：CWE-1221 寄存器默认值或模块参数定义错误 英文：硬件描述语言代码将寄存器默认值或硬件知识产权（IP）参数错误地定义为不安全值。 集成电路和硬件 IP 软件可编程控制及设置通常存储在寄存器电路中。这些寄存器内容必须在硬件复位时初始化为硬件描述语言（HDL）代码中硬编码的默认值。硬件描述语言还支持参数变量的定义，这些参数可以在实例化硬件 IP 模块时在代码中定义。此类参数通常用于配置设计中特定的硬件 IP 实例。硬件设计的系统安全设置可能受到未正确定义的默认值或 IP 参数的影响。硬件 IP 在电源复位时将处于不安全状态，这可能会被系统上运行的不受信任软件暴露或利用。寄存器默认值和参数都是硬编码值，无法通过软件或固件补丁进行更改，而必须在硬件硅片层面进行修改。因此，此类安全问题在后续生命周期阶段解决起来要困难得多。硬件设计可能包含大量此类参数和寄存器默认值设置，因此重要的是要有设计工具支持以自动方式检查这些设置，并能够识别哪些设置是安全敏感的。
常见影响 (1)
Confidentiality, Integrity, Availability, Access Control Varies by Context
Degradation of system functionality, or loss of access control enforcement can occur.
缓解措施 (2)
Architecture and Design During hardware design, all the system parameters and register defaults must be reviewed to identify security sensitive settings.
Implementation The default values of these security sensitive settings need to be defined as part of the design review phase.
代码示例 (2)
Consider example design module system verilog code shown below. The register_example module is an example parameterized module that defines two parameters, REGISTER_WIDTH and REGISTER_DEFAULT. Register_example module defines a Secure_mode setting, which when set makes the register content read-only and not modifiable by software writes. register_top module instantiates two registers, Insecure_Devi…
// Parameterized Register module example // Secure_mode : REGISTER_DEFAULT[0] : When set to 1 register is read only and not writable// module register_example #( parameter REGISTER_WIDTH = 8, // Parameter defines width of register, default 8 bits parameter [REGISTER_WIDTH-1:0] REGISTER_DEFAULT = 2**REGISTER_WIDTH -2 // Default value of register computed from Width. Sets all bits to 1s except bit 0 (Secure _mode) ) ( input [REGISTER_WIDTH-1:0] Data_in, input Clk, input resetn, input write, output reg [REGISTER_WIDTH-1:0] Data_out ); reg Secure_mode; always @(posedge Clk or negedge resetn) if (~
Bad · Verilog
register_example #( .REGISTER_WIDTH (32), .REGISTER_DEFAULT (1225) // Correct default value set, to enable Secure_mode ) Secure_Device_ID_example ( .Data_in (Data_in), .Data_out (Secure_reg), .Clk (Clk), .resetn (resetn), .write (write) );
Good · Verilog
The example code is taken from the fuse memory inside the buggy OpenPiton SoC of HACK@DAC'21 [REF-1356]. Fuse memory can be used to store key hashes, password hashes, and configuration information. For example, the password hashes of JTAG and HMAC are stored in the fuse memory in the OpenPiton design.
parameter  MEM_SIZE = 100; localparam JTAG_OFFSET = 81; const logic [MEM_SIZE-1:0][31:0] mem = { // JTAG expected hamc hash 32'h49ac13af, 32'h1276f1b8, 32'h6703193a, 32'h65eb531b, 32'h3025ccca, 32'h3e8861f4, 32'h329edfe5, 32'h98f763b4, ... assign jtag_hash_o = {mem[JTAG_OFFSET-1],mem[JTAG_OFFSET-2],mem[JTAG_OFFSET-3], mem[JTAG_OFFSET-4],mem[JTAG_OFFSET-5],mem[JTAG_OFFSET-6],mem[JTAG_OFFSET-7],mem[JTAG_OFFSET-8]}; ...
Bad · Verilog
parameter  MEM_SIZE = 100; localparam JTAG_OFFSET = 100;
Good · Verilog
CVE ID 标题 CVSS 风险等级 Published
CVE-2022-20731 Cisco Catalyst Digital Building Series Switches 安全漏洞 — Cisco IOS ROMMON Software 4.6 Medium 2022-04-15
CVE-2022-20661 Cisco Catalyst Digital Building Series Switches 安全漏洞 — Cisco IOS ROMMON Software 4.6 Medium 2022-04-15

CWE-1221 是常见的弱点类别，本平台收录该类弱点关联的 2 条 CVE 漏洞。