CWE-1262: Improper Access Control for Register Interface

Description:
The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers.

Extended Description:
Software commonly accesses peripherals in a System-on-Chip (SoC) or other device through a memory-mapped register interface. Malicious software could tamper with any security-critical hardware data that is accessible directly or indirectly through the register interface, which could lead to a loss of confidentiality and integrity.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-284

Consequences:
  - Confidentiality: Read Memory

Detection methods:
  - Manual Analysis: This is applicable in the Architecture phase before implementation started. Make sure access policy is specified for the entire memory map. Manual analysis may not ensure the implementation is correct
  - Manual Analysis: Registers controlling hardware should have access control implemented. This access control may be checked manually for correct implementation. Items to check consist of how are trusted parties set, ho
  - Simulation / Emulation: Functional simulation is applicable during the Implementation Phase. Testcases must be created and executed for memory mapped registers to verify adherence to the access control policy. This method ca
  - Formal Verification: Formal verification is applicable during the Implementation phase. Assertions need to be created in order to capture illegal register access scenarios and prove that they cannot occur. Formal methods 

Mitigations:
  - [Architecture and Design] Design proper policies for hardware register access from software.
  - [Implementation] Ensure that access control policies for register access are implemented in accordance with the specified design.

Demonstrative examples:
The register interface provides software access to hardware functionality. This functionality is an attack surface. This attack surface may be used to run untrusted code on the system through the register interface. As an example, cryptographic accelerators require a mechanism for software to select modes of operation and to provide plaintext or ciphertext data to be encrypted or decrypted as well as other functions. This functionality is commonly provided through registers.

Cryptographic key material stored in registers inside the cryptographic accelerator can be accessed by software.
Key material stored in registers should never be accessible to software. Even if software can provide a key, all read-back paths to software should be disabled.

The example code is taken from the Control/Status Register (CSR) module inside the processor core of the HACK@DAC'19 buggy CVA6 SoC [REF-1340]. In RISC-V ISA [REF-1341], the CSR file contains different sets of registers with different privilege levels, e.g., user mode (U), supervisor mode (S), hypervisor mode (H), machine mode (M), and debug mode (D), with different read-write policies, read-only (RO) and read-write (RW). For example, machine mode, which is the highest privilege mode in a RISC-V system, registers should not be accessible in user, supervisor, or hypervisor modes.
The vulnerable example code allows the machine exception program counter (MEPC) register to be accessed from a user mode program by excluding the MEPC from the access control check. MEPC as per the RISC-V specifica

Real-world examples:
  - CVE-2014-2915: virtualization product does not restrict access to debug and other processor registers in the hardware, allowing a crash of the host or guest OS
  - CVE-2021-3011: virtual interrupt controller in a virtualization product allows crash of host by writing a certain invalid value to a register, which triggers a fatal error instead of returning an error code
  - CVE-2020-12446: Driver exposes access to Model Specific Register (MSR) registers, allowing admin privileges.
  - CVE-2015-2150: Virtualization product does not restrict access to PCI command registers, allowing host crash from the guest.