Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-1256 — Vulnerability Class 3

3 vulnerabilities classified as CWE-1256. AI Chinese analysis included.

CWE-1256 represents a critical architectural weakness where software interfaces fail to adequately restrict access to sensitive hardware features, such as power management, clock control, or low-level register modifications. This flaw typically enables attackers to exploit the system through physical side-channel analysis or fault injection attacks, allowing them to manipulate hardware states, extract cryptographic keys, or induce system failures by observing power consumption or electromagnetic emissions. Developers can mitigate this risk by implementing strict hardware-enforced access controls, ensuring that only authorized, privileged processes can modify critical registers or power states. Additionally, employing constant-time algorithms, randomizing execution timing, and integrating robust physical tamper detection mechanisms help obscure side-channel data, thereby preventing adversaries from leveraging these hardware interfaces for malicious exploitation.

MITRE CWE Description
The product provides software-controllable device functionality for capabilities such as power and clock management, but it does not properly limit functionality that can lead to modification of hardware memory or register bits, or the ability to observe physical side channels. It is frequently assumed that physical attacks such as fault injection and side-channel analysis require an attacker to have physical access to the target device. This assumption may be false if the device has improperly secured power management features, or similar features. For mobile devices, minimizing power consumption is critical, but these devices run a wide variety of applications with different performance requirements. Software-controllable mechanisms to dynamically scale device voltage and frequency and monitor power consumption are common features in today's chipsets, but they also enable attackers to mount fault injection and side-channel attacks without having physical access to the device. Fault injection attacks involve strategic manipulation of bits in a device to achieve a desired effect such as skipping an authentication step, elevating privileges, or altering the output of a cryptographic operation. Manipulation of the device …
Common Consequences (1)
IntegrityModify Memory, Modify Application Data, Bypass Protection Mechanism
Mitigations (1)
Architecture and Design, ImplementationEnsure proper access control mechanisms protect software-controllable features altering physical operating conditions such as clock frequency and voltage.
Examples (2)
This example considers the Rowhammer problem [REF-1083]. The Rowhammer issue was caused by a program in a tight loop writing repeatedly to a location to which the program was allowed to write but causing an adjacent memory location value to change.
Continuously writing the same value to the same address causes the value of an adjacent location to change value.
Bad · Other
Redesign the RAM devices to reduce inter capacitive coupling making the Rowhammer exploit impossible.
Good · Other
Suppose a hardware design implements a set of software-accessible registers for scaling clock frequency and voltage but does not control access to these registers. Attackers may cause register and memory changes and race conditions by changing the clock or voltage of the device under their control.
CVE IDTitleCVSSSeverityPublished
CVE-2024-5477 HP PC 安全漏洞 — Certain HP PC Products 6.8AIMediumAI2025-08-13
CVE-2024-2881 Fault Injection of EdDSA signature in WolfCrypt — wolfCrypt 6.7 Medium2024-08-29
CVE-2024-1545 Fault Injection of RSA encryption in WolfCrypt — wolfCrypt 5.9 Medium2024-08-29

Vulnerabilities classified as CWE-1256 represent 3 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.