MITRE has just released the list of most important hardware weaknesses that lead to security vulnerabilities.
“The 2021 CWE™ Most Important Hardware Weaknesses is the first of its kind and the result of collaboration within the Hardware CWE Special Interest Group (SIG), a community forum for individuals representing organizations within hardware design, manufacturing, research, and security domains, as well as academia and government.
The goals for the 2021 Hardware List are to drive awareness of common hardware weaknesses through CWE, and to prevent hardware security issues at the source by educating designers and programmers on how to eliminate important mistakes early in the product development lifecycle. Security analysts and test engineers can use the list in preparing plans for security testing and evaluation. Hardware consumers could use the list to help them to ask for more secure hardware products from their suppliers. Finally, managers and CIOs can use the list as a measuring stick of progress in their efforts to secure their hardware and ascertain where to direct resources to develop security tools or automation processes that mitigate a wide class of vulnerabilities by eliminating the underling root cause.
MITRE maintains the CWE web site with the support of the US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), presenting detailed descriptions of the 2021 Hardware List weaknesses along with authoritative guidance for mitigating and avoiding them. The CWE site contains data on more than 900 programming, design, and architecture weaknesses that can lead to exploitable vulnerabilities. “
| Link | Weakness |
|---|---|
| CWE-1189 | Improper Isolation of Shared Resources on System-on-a-Chip (SoC) |
| CWE-1191 | On-Chip Debug and Test Interface With Improper Access Control |
| CWE-1231 | Improper Prevention of Lock Bit Modification |
| CWE-1233 | Security-Sensitive Hardware Controls with Missing Lock Bit Protection |
| CWE-1240 | Use of a Cryptographic Primitive with a Risky Implementation |
| CWE-1244 | Internal Asset Exposed to Unsafe Debug Access Level or State |
| CWE-1256 | Improper Restriction of Software Interfaces to Hardware Features |
| CWE-1260 | Improper Handling of Overlap Between Protected Memory Ranges |
| CWE-1272 | Sensitive Information Uncleared Before Debug/Power State Transition |
| CWE-1274 | Improper Access Control for Volatile Memory Containing Boot Code |
| CWE-1277 | Firmware Not Updateable |
| CWE-1300 | Improper Protection of Physical Side Channels |
Source: The MITRE Corporation’s Common Weakness Enumeration (CWE)
Find more details on the hardware weakness list for 2021 here.
Note, MITRE also publishes the CWE Top-25 Most Dangerous Software Weaknesses on an annual basis.
Related
Semiconductor Security Knowledge Center
Top stories, special reports, videos, white papers, and blogs on security
Is There A Practical Test For Rowhammer Vulnerability?
New approaches surface for persistent DRAM issue.
Security Research Bits
New security technical papers presented at the August 21 USENIX Security Symposium.
Securing ICs With Information Flow Analysis
Tracking how data moves is essential for secure designs.
Leave a Reply