Security Version Number Mutable to Older Versions

Opis

Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.

A System-on-Chip (SoC) implements secure boot or verified boot. It might support a security version number, which prevents downgrading the current firmware to a vulnerable version. Once downgraded to a previous version, an adversary can launch exploits on the SoC and thus compromise the security of the SoC. These downgrade attacks are also referred to as roll-back attacks.

The security version number must be stored securely and persistently across power-on resets. A common weakness is that the security version number is modifiable by an adversary, allowing roll-back or downgrade attacks or, under certain circumstances, preventing upgrades (i.e. Denial-of-Service on upgrades). In both cases, the SoC is in a vulnerable state.

Skutki

• Confidentiality, Integrity, Authentication, Authorization

  Other

  Impact includes roll-back or downgrade to a vulnerable version of the firmware or DoS (prevent upgrades).

Zapobieganie

• Architecture and Design

  When architecting the system, security version data should be designated for storage in registers that are either read-only or have access controls that prevent modification by an untrusted agent.

• Implementation

  During implementation and test, security version data should be demonstrated to be read-only and access controls should be validated.

Słabość nadrzędna

• CWE-285 Improper Authorization

Pokrewna

• CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Kiedy powstaje

• Architecture and Design
• Implementation — Such issues could be introduced during hardware architecture and design, and can be identified later during testing or system configuration phases.

Dotyczy

Not Language-Specific, Not OS-Specific, Not Architecture-Specific, Security Hardware, Not Technology-Specific