目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-1245 类漏洞列表 2

CWE-1245 类弱点 2 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1245指硬件逻辑中有限状态机实现不当的漏洞。攻击者常利用状态转换缺陷将系统置于未定义状态，从而引发拒绝服务或获取特权。由于系统功能与安全高度依赖状态机实现，开发者需严格验证状态转换逻辑，确保所有路径均符合安全规范，防止非法状态触发，以保障硬件逻辑的完整性与安全性。

MITRE CWE 官方描述
CWE：CWE-1245 硬件逻辑中的有限状态机（FSMs）实现不当 英文：硬件逻辑中错误的有限状态机（FSMs）会使攻击者能够将系统置于未定义状态，从而导致拒绝服务（DoS）或在受害者系统上获取权限。 系统的功能性和安全性在很大程度上依赖于有限状态机（FSMs）的实现。有限状态机（FSMs）可用于指示系统当前的安全状态。许多安全的数据操作和数据传输都依赖于有限状态机（FSMs）所报告的状态。
常见影响 (1)
Availability, Access ControlUnexpected State, DoS: Crash, Exit, or Restart, DoS: Instability, Gain Privileges or Assume Identity
Faulty FSM designs that do not account for all states, either through undefined states (left as don't cares) or through incorrect implementation, might lead an attacker to drive the system into an unstable state from which the system cannot recover without a reset, thus causing a DoS. Depending on w…
缓解措施 (1)
Architecture and Design, ImplementationDefine all possible states and handle all unused states through default statements. Ensure that system defaults to a secure state.
Effectiveness: High
代码示例 (1)
The Finite State Machine (FSM) shown in the "bad" code snippet below assigns the output ("out") based on the value of state, which is determined based on the user provided input ("user_input").
module fsm_1(out, user_input, clk, rst_n); input [2:0] user_input; input clk, rst_n; output reg [2:0] out; reg [1:0] state; always @ (posedge clk or negedge rst_n ) begin if (!rst_n) state = 3'h0; else case (user_input) 3'h0: 3'h1: 3'h2: 3'h3: state = 2'h3; 3'h4: state = 2'h2; 3'h5: state = 2'h1; endcase end out <= {1'h1, state}; endmodule
Bad · Verilog
case (user_input) 3'h0: 3'h1: 3'h2: 3'h3: state = 2'h3; 3'h4: state = 2'h2; 3'h5: state = 2'h1; default: state = 2'h0; endcase
Good · Verilog
CVE ID标题CVSS风险等级Published
CVE-2025-48508 AMD Graphics Driver 安全漏洞 — AMD Radeon™ PRO V710 6.0 Medium2026-02-11
CVE-2024-58311 Dormakaba Saflok System 安全漏洞 — Dormakaba Saflok System 6000 9.8 Critical2025-12-12

CWE-1245 是常见的弱点类别，本平台收录该类弱点关联的 2 条 CVE 漏洞。