CWE-1304 - Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
CWE-1304
- Abstraction:
- Base
- Structure:
- Simple
- Status:
- Draft
- Weakness Name
Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
- Description
The product performs a power save/restore operation, but it does not ensure that the integrity of the configuration state is maintained and/or verified between the beginning and ending of the operation.
Before powering down, the Intellectual Property (IP) saves current state (S) to persistent storage such as flash or always-on memory in order to optimize the restore operation. During this process, an attacker with access to the persistent storage may alter (S) to a configuration that could potentially modify privileges, disable protections, and/or cause damage to the hardware. If the IP does not validate the configuration state stored in persistent memory, upon regaining power or becoming operational again, the IP could be compromised through the activation of an unwanted/harmful configuration.
- Common Consequences
Scope: Confidentiality, Integrity
Impact: DoS: Instability, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (Other), Gain Privileges or Assume Identity, Bypass Protection Mechanism, Alter Execution Logic, Quality Degradation, Unexpected State, Reduce Maintainability, Reduce Performance, Reduce Reliability
- Related Weaknesses
- Release Date:
- 2020-08-20
- Latest Modification Date:
- 2023-06-29
Free security scan for your website