Missing Immutable Root of Trust in Hardware

Opis

A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.

A System-on-Chip (SoC) implements secure boot by verifying or authenticating signed boot code. The signing of the code is achieved by an entity that the SoC trusts. Before executing the boot code, the SoC verifies that the code or the public key with which the code has been signed has not been tampered with. The other data upon which the SoC depends are system-hardware settings in fuses such as whether "Secure Boot is enabled". These data play a crucial role in establishing a Root of Trust (RoT) to execute secure-boot flows.

One of the many ways RoT is achieved is by storing the code and data in memory or fuses. This memory should be immutable, i.e., once the RoT is programmed/provisioned in memory, that memory should be locked and prevented from further programming or writes. If the memory contents (i.e., RoT) are mutable, then an adversary can modify the RoT to execute their choice of code, resulting in a compromised secure boot.

Note that, for components like ROM, secure patching/update features should be supported to allow authenticated and authorized updates in the field.

Skutki

• Authentication, Authorization

  Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands; Modify Memory

Zapobieganie

• Architecture and Design

  When architecting the system, the RoT should be designated for storage in a memory that does not allow further programming/writes.

• Implementation

  During implementation and test, the RoT memory location should be demonstrated to not allow further programming/writes.

Słabość nadrzędna

• CWE-693 Protection Mechanism Failure

Kiedy powstaje

• Architecture and Design
• Implementation — Such issues could be introduced during policy definition, hardware architecture, design, manufacturing, and/or provisioning. They can be identified later during testing or system configuration phases.

Dotyczy

Not Language-Specific, Not OS-Specific, Not Architecture-Specific, Security Hardware, Not Technology-Specific

Źródła

1. TCG Roots of Trust Specification — Trusted Computing Group, 2018
2. Root of Trust Definitions and Requirements — GlobalPlatform Security Task Force, 2017
3. bootrom.sv — 2019
4. bootrom.sv — 2019