Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
Draft Base
Structure: Simple
Description
The firewall in an on-chip fabric protects the main addressed region, but it does not protect any mirrored memory or memory-mapped-IO (MMIO) regions.
Few fabrics mirror memory and address ranges, where mirrored regions contain copies of the original data. This redundancy is used to achieve fault tolerance. Whatever protections the fabric firewall implements for the original region should also apply to the mirrored regions. If not, an attacker could bypass existing read/write protections by reading from/writing to the mirrored regions to leak or corrupt the original data.
Common Consequences 1
Scope: ConfidentialityIntegrityAccess Control
Impact: Modify MemoryRead MemoryBypass Protection Mechanism
Detection Methods 1
Manual Dynamic AnalysisHigh
Using an external debugger, send write transactions to mirrored regions to test if original, write-protected regions are modified. Similarly, send read transactions to mirrored regions to test if the original, read-protected signals can be read.Potential Mitigations 2
Phase: Architecture and Design
The fabric firewall should apply the same protections as the original region to the mirrored regions.
Phase: Implementation
The fabric firewall should apply the same protections as the original region to the mirrored regions.
Demonstrative Examples 1
A memory-controller IP block is connected to the on-chip fabric in a System on Chip (SoC). The memory controller is configured to divide the memory into four parts: one original and three mirrored regions inside the memory. The upper two bits of the address indicate which region is being addressed. 00 indicates the original region and 01, 10, and 11 are used to address the mirrored regions. All four regions operate in a lock-step manner and are always synchronized. The firewall in the on-chip fabric is programmed to protect the assets in the memory.
The firewall only protects the original range but not the mirrored regions.
The attacker (as an unprivileged user) sends a write transaction to the mirrored region. The mirrored region has an address with the upper two bits set to "10" and the remaining bits of the address pointing to an asset. The firewall does not block this write transaction. Once the write is successful, contents in the protected-memory region are also updated. Thus, the attacker can bypass existing, memory protections.
Firewall should protect mirrored regions.
References 1
Address Range Memory Mirroring
Taku Izumi, Fujitsu Limited
2016
ID: REF-1134
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Technologies:
Not Technology-Specific : Undetermined
Modes of Introduction
Architecture and Design
Implementation
Related Attack Patterns
Related Weaknesses