目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-1262 类漏洞列表 8

CWE-1262 类弱点 8 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1262 指内存映射 I/O 寄存器访问控制不当的漏洞。攻击者通常利用此缺陷，通过恶意软件直接篡改安全关键硬件数据，从而绕过软件层面的保护机制，获取未授权的设备控制权或敏感信息。开发者应避免直接暴露寄存器接口，实施严格的权限验证与隔离机制，确保仅授权进程能访问关键硬件资源，从而防止恶意代码对底层硬件进行非法操作。

MITRE CWE 官方描述
CWE：CWE-1262 注册接口访问控制不当 英文：该产品使用内存映射 I/O（Memory-Mapped I/O）寄存器作为软件访问硬件功能的接口，但针对这些寄存器的访问控制不当。 软件通常通过内存映射寄存器接口访问片上系统（System-on-Chip, SoC）或其他设备中的外设。恶意软件可能会篡改通过该寄存器接口直接或间接可访问的任何安全关键型硬件数据，从而导致机密性和完整性受损。
常见影响 (1)
Confidentiality, Integrity Read Memory, Read Application Data, Modify Memory, Modify Application Data, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Unexpected State, Alter Execution Logic
Confidentiality of hardware assets may be violated if the protected information can be read out by software through the register interface. Registers storing security state, settings, other security-critical data may be corruptible by software without correctly implemented protections.
缓解措施 (2)
Architecture and Design Design proper policies for hardware register access from software.
Implementation Ensure that access control policies for register access are implemented in accordance with the specified design.
代码示例 (2)
The register interface provides software access to hardware functionality. This functionality is an attack surface. This attack surface may be used to run untrusted code on the system through the register interface. As an example, cryptographic accelerators require a mechanism for software to select modes of operation and to provide plaintext or ciphertext data to be encrypted or decrypted as well…
Cryptographic key material stored in registers inside the cryptographic accelerator can be accessed by software.
Bad · Other
Key material stored in registers should never be accessible to software. Even if software can provide a key, all read-back paths to software should be disabled.
Good · Other
The example code is taken from the Control/Status Register (CSR) module inside the processor core of the HACK@DAC'19 buggy CVA6 SoC [REF-1340]. In RISC-V ISA [REF-1341], the CSR file contains different sets of registers with different privilege levels, e.g., user mode (U), supervisor mode (S), hypervisor mode (H), machine mode (M), and debug mode (D), with different read-write policies, read-only …
if (csr_we || csr_read) begin if ((riscv::priv_lvl_t'(priv_lvl_o & csr_addr.csr_decode.priv_lvl) != csr_addr.csr_decode.priv_lvl) && !(csr_addr.address==riscv::CSR_MEPC)) begin csr_exception_o.cause = riscv::ILLEGAL_INSTR; csr_exception_o.valid = 1'b1; end // check access to debug mode only CSRs if (csr_addr_i[11:4] == 8'h7b && !debug_mode_q) begin csr_exception_o.cause = riscv::ILLEGAL_INSTR; csr_exception_o.valid = 1'b1; end end
Bad · Verilog
if (csr_we || csr_read) begin if ((riscv::priv_lvl_t'(priv_lvl_o & csr_addr.csr_decode.priv_lvl) != csr_addr.csr_decode.priv_lvl)) begin csr_exception_o.cause = riscv::ILLEGAL_INSTR; csr_exception_o.valid = 1'b1; end // check access to debug mode only CSRs if (csr_addr_i[11:4] == 8'h7b && !debug_mode_q) begin csr_exception_o.cause = riscv::ILLEGAL_INSTR; csr_exception_o.valid = 1'b1; end end
Good · Verilog
CVE ID 标题 CVSS 风险等级 Published
CVE-2025-33207 CVE-2025-33207 — BlueField GA 6.8 Medium 2026-09-29
CVE-2025-54509 AMD secure processor 安全漏洞 — AMD EPYC™ 9004 Series Processors 4.0 Medium 2026-06-09
CVE-2025-47385 Qualcomm Chipsets 安全漏洞 — Snapdragon 7.8 High 2026-03-02
CVE-2025-36194 IBM PowerVM Hypervisor 安全漏洞 — PowerVM Hypervisor 2.8 Low 2026-02-02
CVE-2025-20788 MediaTek Chipsets 安全漏洞 — MT6991, MT8196 5.0AI Medium AI 2025-12-02
CVE-2023-20599 AMD EPYC 安全漏洞 — AMD EPYC™ 7002 Series Processors 7.9 High 2025-06-10
CVE-2024-45556 Qualcomm Chipsets 安全漏洞 — Snapdragon 6.5 Medium 2025-04-07
CVE-2025-1882 i-Drive i11和i-Drive i12 安全漏洞 — i11 5.0 Medium 2025-03-03

CWE-1262 是常见的弱点类别，本平台收录该类弱点关联的 8 条 CVE 漏洞。