The lack of protections on alternate paths to access
control-protected assets (such as unprotected shadow registers
and other external facing unguarded interfaces) allows an
attacker to bypass existing protections to the asset that are
only performed against the primary path.

An asset inside a chip might have access-control
protections through one interface. However, if all paths to
the asset are not protected, an attacker might compromise
the asset through alternate paths. These alternate paths
could be through shadow or mirror registers inside the IP
core, or could be paths from other external-facing
interfaces to the IP core or SoC.
Consider an SoC with various interfaces such as UART,
SMBUS, PCIe, USB, etc. If access control is implemented for
SoC internal registers only over the PCIe interface, then
an attacker could still modify the SoC internal registers
through alternate paths by coming through interfaces such
as UART, SMBUS, USB, etc.
Alternatively, attackers might be able to bypass
existing protections by exploiting unprotected, shadow
registers. Shadow registers and mirror registers typically
refer to registers that can be accessed from multiple
addresses. Writing to or reading from the aliased/mirrored
address has the same effect as writing to the address of
the main register. They are typically implemented within an
IP core or SoC to temporarily hold certain data. These data
will later be updated to the main register, and both
registers will be in synch. If the shadow registers are not
access-protected, attackers could simply initiate
transactions to the shadow registers and compromise system
security.

Primary

Architecture and Design

Implementation

Confidentiality
Integrity
Availability
Access Control
Modify Memory
Read Memory
DoS: Resource Consumption (Other)
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity
Alter Execution Logic
Bypass Protection Mechanism
Quality Degradation
High

Requirements
Protect assets from accesses against all potential interfaces and alternate paths.
Defense in Depth

Architecture and Design
Protect assets from accesses against all potential interfaces and alternate paths.
Defense in Depth

Implementation
Protect assets from accesses against all potential interfaces and alternate paths.
Defense in Depth

Register SECURE_ME is located at address 0xF00. A
mirror of this register called COPY_OF_SECURE_ME is
at location 0x800F00. The register SECURE_ME is
protected from malicious agents and only allows
access to select, while COPY_OF_SECURE_ME is not.

Access control is implemented using an allowlist (as
indicated by acl_oh_allowlist). The identity of the
initiator of the transaction is indicated by the
one hot input, incoming_id. This is checked against
the acl_oh_allowlist (which contains a list of
initiators that are allowed to access the asset).

Though this example is shown in Verilog, it will
apply to VHDL as well.

module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n);
output [31:0] data_out;
input [31:0] data_in, incoming_id, address;
input clk, rst_n;
wire write_auth, addr_auth;
reg [31:0] data_out, acl_oh_allowlist, q;
assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0;
always @*

acl_oh_allowlist <= 32'h8312;

assign addr_auth = (address == 32'hF00) ? 1: 0;
always @ (posedge clk or negedge rst_n)

if (!rst_n)

begin

q <= 32'h0;
data_out <= 32'h0;

end

else

begin

q <= (addr_auth & write_auth) ? data_in: q;
data_out <= q;

end

end

endmodule

assign addr_auth = (address == 32'hF00) ? 1: 0;
The bugged line of code is repeated in the Bad
example above. The weakness arises from the fact that the
SECURE_ME register can be modified by writing to the
shadow register COPY_OF_SECURE_ME. The address of
COPY_OF_SECURE_ME should also be included in the check.
That buggy line of code should instead be replaced as
shown in the Good Code Snippet below.

assign addr_auth = (address == 32'hF00 || address == 32'h800F00) ? 1: 0;

CVE-2022-38399
Missing protection mechanism on serial connection allows for arbitrary OS command execution.
https://www.cve.org/CVERecord?id=CVE-2022-38399

CVE-2020-9285
Mini-PCI Express slot does not restrict direct memory access.
https://www.cve.org/CVERecord?id=CVE-2020-9285

CVE-2020-8004
When the internal flash is protected by blocking access on the Data Bus (DBUS), it can still be indirectly accessed through the Instruction Bus (IBUS).
https://www.cve.org/CVERecord?id=CVE-2020-8004

CVE-2017-18293
When GPIO is protected by blocking access
to corresponding GPIO resource registers,
protection can be bypassed by writing to the
corresponding banked GPIO registers instead.

https://www.cve.org/CVERecord?id=CVE-2017-18293

CVE-2020-15483
monitor device allows access to physical UART debug port without authentication
https://www.cve.org/CVERecord?id=CVE-2020-15483

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi
Intel Corporation
2019-10-02
4.2
2020-08-20

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2021-07-20
updated Observed_Examples, Related_Attack_Patterns

CWE Content Team
MITRE
2022-04-28
updated Applicable_Platforms, Common_Consequences, Related_Attack_Patterns

CWE Content Team
MITRE
2022-06-28
updated Applicable_Platforms

CWE Content Team
MITRE
2023-01-31
updated Related_Attack_Patterns

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Demonstrative_Examples, Observed_Examples

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities