Executar análise estática (SAST) na base de código à procura do padrão inseguro no fluxo de dados.
CWE-1264 Base Incompleto
Hardware Logic with Insecure De-Synchronization between Control and Data Channels
This vulnerability occurs when a hardware design incorrectly forwards data before its security or permission checks have finished processing. It's a timing flaw where the data channel gets ahead of…
Definição
What is CWE-1264?
This vulnerability occurs when a hardware design incorrectly forwards data before its security or permission checks have finished processing. It's a timing flaw where the data channel gets ahead of the control channel, potentially leaking information.
Modern hardware often uses separate control and data channels to boost performance. A bug in the logic that manages errors and security can allow data to 'race ahead' and be used or observed before the system confirms it's safe to do so. This desynchronization creates a critical window where unauthorized data access can happen.
The real-world impact is a loss of data confidentiality, as seen in exploits like Meltdown. In that case, a CPU speculatively loaded privileged data for performance, assuming it could clean up all traces if the access was later deemed illegal. However, secret data remained in the microarchitectural state, proving that assumption false and allowing attackers to retrieve it.
Impacto no mundo real
Real-world CVEs caused by CWE-1264
-
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.
Como os atacantes a exploram
Trajeto do atacante passo a passo
- 1
Identificar um caminho de código que trata input não confiável sem validação.
- 2
Criar um payload que explora o comportamento inseguro — injeção, traversal, overflow ou abuso de lógica.
- 3
Entregar o payload através de um pedido normal e observar a reação da aplicação.
- 4
Iterar até que a resposta exponha dados, execute código do atacante ou escale privilégios.
Exemplo de código vulnerável
Vulnerable Other
There are several standard on-chip bus protocols used in modern SoCs to allow communication between components. There are a wide variety of commercially available hardware IP implementing the interconnect logic for these protocols. A bus connects components which initiate/request communications such as processors and DMA controllers (bus masters) with peripherals which respond to requests. In a typical system, the privilege level or security designation of the bus master along with the intended functionality of each peripheral determine the security policy specifying which specific bus masters can access specific peripherals. This security policy (commonly referred to as a bus firewall) can be enforced using separate IP/logic from the actual interconnect responsible for the data routing.
The firewall and data routing logic becomes de-synchronized due to a hardware logic bug allowing components that should not be allowed to communicate to share data. For example, consider an SoC with two processors. One is being used as a root of trust and can access a cryptographic key storage peripheral. The other processor (application cpu) may run potentially untrusted code and should not access the key store. If the application cpu can issue a read request to the key store which is not blocked due to de-synchronization of data routing and the bus firewall, disclosure of cryptographic keys is possible. Exemplo de código seguro
Secure Other
All data is correctly buffered inside the interconnect until the firewall has determined that the endpoint is allowed to receive the data. What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de verificação de prevenção
How to prevent CWE-1264
- Architecture and Design Thoroughly verify the data routing logic to ensure that any error handling or security checks effectively block illegal dataflows.
Sinais de deteção
How to detect CWE-1264
Executar testes dinâmicos de segurança de aplicações (DAST) contra o endpoint em execução.
Monitorizar os registos em tempo de execução para traços de exceção invulgares, input malformado ou tentativas de contornar a autorização.
Revisão de código: sinalizar qualquer novo código que trate input desta superfície sem usar os ajudantes validados do framework.
CWE-1264
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Perguntas frequentes O que é o CWE-1264?
Qual a gravidade do CWE-1264?
Que linguagens ou plataformas são afetadas pelo CWE-1264?
Como posso prevenir o CWE-1264?
Como é que o Plexicus deteta e corrige o CWE-1264?
Onde posso saber mais sobre o CWE-1264?
Frequently asked questions
O que é o CWE-1264?
This vulnerability occurs when a hardware design incorrectly forwards data before its security or permission checks have finished processing. It's a timing flaw where the data channel gets ahead of the control channel, potentially leaking information.
Qual a gravidade do CWE-1264?
A MITRE não publicou uma classificação de probabilidade de exploração para esta fraqueza. Trate-a como impacto médio até o seu modelo de ameaças provar o contrário.
Que linguagens ou plataformas são afetadas pelo CWE-1264?
MITRE lists the following affected platforms: Not OS-Specific, Not Architecture-Specific, Not Technology-Specific.
Como posso prevenir o CWE-1264?
Thoroughly verify the data routing logic to ensure that any error handling or security checks effectively block illegal dataflows.
Como é que o Plexicus deteta e corrige o CWE-1264?
O motor SAST do Plexicus correlaciona a assinatura de fluxo de dados do CWE-1264 em cada commit. Quando é encontrada uma correspondência, o nosso agente Codex Remedium abre um PR de correção com o código corrigido, testes e um resumo de uma linha para o revisor.
Onde posso saber mais sobre o CWE-1264?
A MITRE publica a definição canónica em https://cwe.mitre.org/data/definitions/1264.html. Pode também consultar a documentação da OWASP e do NIST para orientações adjacentes.
Fraquezas relacionadas
Weaknesses related to CWE-1264
CWE-821 Pai
Incorrect Synchronization
This vulnerability occurs when multiple parts of a program, such as threads or processes, access a shared resource like a variable, file,…
CWE-1088 Irmão
Synchronous Access of Remote Resource without Timeout
This vulnerability occurs when an application makes a synchronous call to a remote service or resource but does not set a timeout, or sets…
CWE-572 Irmão
Call to Thread run() instead of start()
This vulnerability occurs when a program incorrectly calls a thread's `run()` method directly, instead of using the `start()` method. This…
CWE-574 Irmão
EJB Bad Practices: Use of Synchronization Primitives
This vulnerability occurs when an Enterprise JavaBeans (EJB) component improperly uses thread synchronization primitives, violating the…
CWE-1037 Par
Processor Optimization Removal or Modification of Security-critical Code
This vulnerability occurs when a processor's performance optimization unintentionally strips out or alters security-critical code that a…
Pronto para validar o que importa?
Pronto para validar o que importa.
O Plexicus é Proof-Driven AppSec: achados validados, compreensão contextual e remediação revisada — ancorada em evidência, escopada com você.