The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents.
View on MITREA System-On-a-Chip (SoC) has a lot of functionality, but it may have a limited number of pins or pads. A pin can only perform one function at a time. However, it can be configured to perform multiple different functions. This technique is called pin multiplexing. Similarly, several resources on the chip may be shared to multiplex and support different features or functions. When such resources are shared between trusted and untrusted agents, untrusted agents may be able to access the assets intended to be accessed only by the trusted agents.
If resources being used by a trusted user are shared with an untrusted user, the untrusted user may be able to modify the functionality of the shared resource of the trusted user.
The functionality of the shared resource may be intentionally degraded.
When sharing resources, avoid mixing agents of varying trust levels. Untrusted agents should not share resources with trusted agents.
Pre-silicon / post-silicon: Test access to shared systems resources (memory ranges, control registers, etc.) from untrusted software to verify that the assets are not incorrectly exposed to untrusted agents. Note that access to shared resources can be dynamically allowed or revoked based on system flows. Security testing should cover such dynamic shared resource allocation and access control modification flows.
Processor has improper isolation of shared resources allowing for information disclosure.
View DetailsBaseboard Management Controller (BMC) device implements Advanced High-performance Bus (AHB) bridges that do not require authentication for arbitrary read and write access to the BMC's physical address space from the host, and possibly the network [REF-1138].
View DetailsNo relationship information available for this CWE.
CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC) is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents. A System-On-a-Chip (SoC) has a lot of functionality, but it may have a limited number of pins or pads. A pin can only perform one function at a time. However, it can be configured to perform multiple different functions. This technique is called pin multiplexing. Similarly, several resources on the chip may be shared to multiplex and support different features or functions. When such resources are shared between trusted and untrusted agents, untrusted agents may be able to access the assets intended to be accessed only by the trusted agents.
If exploited, CWE-1189 (Improper Isolation of Shared Resources on System-on-a-Chip (SoC)) it can compromise Access Control and Integrity, leading to outcomes such as Bypass Protection Mechanism and Quality Degradation.
Recommended mitigations for CWE-1189 include: When sharing resources, avoid mixing agents of varying trust levels. Untrusted agents should not share resources with trusted agents.
CWE-1189 can be detected using Automated Dynamic Analysis. Combining automated tooling with manual review typically yields the best coverage.
CWE-1189 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-1189, including CVE-2020-8698 and CVE-2019-6260. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-1189 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.