CWE-1311: Improper Translation of Security Attributes by Fabric Bridge

Extended Description

A bridge allows IP blocks supporting different fabric protocols to be integrated into the system. Fabric end-points or interfaces usually have dedicated signals to transport security attributes. For example, HPROT signals in AHB, AxPROT signals in AXI, and MReqInfo and SRespInfo signals in OCP. The values on these signals are used to indicate the security attributes of the transaction. These include the immutable hardware identity of the controller initiating the transaction, privilege level, and type of transaction (e.g., read/write, cacheable/non-cacheable, posted/non-posted). A weakness can arise if the bridge IP block, which translates the signals from the protocol used in the IP block endpoint to the protocol used by the central bus, does not properly translate the security attributes. As a result, the identity of the initiator could be translated from untrusted to trusted or vice-versa. This could result in access-control bypass, privilege escalation, or denial of service.

Code Examples & CVEs

Demonstrative Examples

The bridge interfaces between OCP and AHB end points. OCP uses MReqInfo signal to indicate security attributes, whereas AHB uses HPROT signal to indicate the security attributes. The width of MReqInfo can be customized as needed. In this example, MReqInfo is 5-bits wide and carries the privilege level of the OCP controller. The values 5'h11, 5'h10, 5'h0F, 5'h0D, 5'h0C, 5'h0B, 5'h09, 5'h08, 5'h04, and 5'h02 in MReqInfo indicate that the request is coming from a privileged state of the OCP bus controller. Values 5'h1F, 5'h0E, and 5'h00 indicate untrusted, privilege state. Though HPROT is a 5-bit signal, we only consider the lower, two bits in this example. HPROT values 2'b00 and 2'b10 are considered trusted, and 2'b01 and 2'b11 are considered untrusted. The OCP2AHB bridge is expected to translate trusted identities on the controller side to trusted identities on the responder side. Similarly, it is expected to translate untrusted identities on the controller side to untrusted identities on the responder side.

Logic in the case statement only checks for MReqInfo bits 4:2, i.e., hardware-identity bits 3:1. When ocp_mreqinfo is 5'h1F or 5'h0E, p0_mreqinfo_o_temp[2] will be 1. As a result, untrusted IDs from OCP 5'h1F and 5'h0E get translated to trusted ahb_hprot values 2'b00.

BadVerilog

module ocp2ahb 	      (  	       	        ahb_hprot,  	        ocp_mreqinfo  	       	      );  	       	      output [1:0] ahb_hprot;        // output is 2 bit signal for AHB HPROT 	      input [4:0] ocp_mreqinfo;      // input is 5 bit signal from OCP MReqInfo 	      wire [6:0] p0_mreqinfo_o_temp; // OCP signal that transmits hardware identity of bus controller 	        	      wire y; 	       	      reg [1:0] ahb_hprot; 	       	      // hardware identity of bus controller is in bits 5:1 of p0_mreqinfo_o_temp signal 	      assign p0_mreqinfo_o_temp[6:0] = {1'b0, ocp_mreqinfo[4:0], y}; 	       	      always @* 	      begin 	       	        case (p0_mreqinfo_o_temp[4:2]) 		 	          000: ahb_hprot = 2'b11;    // OCP MReqInfo to AHB HPROT mapping 	          001: ahb_hprot = 2'b00; 	          010: ahb_hprot = 2'b00; 	          011: ahb_hprot = 2'b01; 	          100: ahb_hprot = 2'b00; 	          101: ahb_hprot = 2'b00; 	          110: ahb_hprot = 2'b10; 	          111: ahb_hprot = 2'b00; 		 	        endcase 	       	      end 	      endmodule

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-1311 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-1311, Improper Translation of Security Attributes by Fabric Bridge, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Improper Translation of Security Attributes by Fabric Bridge during Architecture and Design

MITRE associates mitigation with Architecture and Design, and Implementation; recorded impacts include Modify Memory, Read Memory, Gain Privileges or Assume Identity, Bypass Protection Mechanism, and Execute Unauthorized Code or Commands; the entry maps to CAPEC-1, CAPEC-180, and CAPEC-233. Use these source-defined anchors to turn CWE-1311 into implementation, review, and verification checks for the affected component.

CWE-1311: Improper Translation of Security Attributes by Fabric Bridge — MITRE CWE

Triage CWE-1311 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-1311, Improper Translation of Security Attributes by Fabric Bridge, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-1311

Apply MITRE's full root-cause mapping guidance when using CWE-1311, Improper Translation of Security Attributes by Fabric Bridge. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-1311 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-1311, Improper Translation of Security Attributes by Fabric Bridge. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-1311: Improper Translation of Security Attributes by Fabric Bridge?+

CWE-1311: Improper Translation of Security Attributes by Fabric Bridge is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another. A bridge allows IP blocks supporting different fabric protocols to be integrated into the system. Fabric end-points or interfaces usually have dedicated signals to transport security attributes. For example, HPROT signals in AHB, AxPROT signals in AXI, and MReqInfo and SRespInfo signals in OCP. The values on these signals are used to indicate the security attributes of the transaction. These include the immutable hardware identity of the controller initiating the transaction, privilege level, and type of transaction (e.g., read/write, cacheable/non-cacheable, posted/non-posted). A weakness can arise if the bridge IP block, which translates the signals from the protocol used in the IP block endpoint to the protocol used by the central bus, does not properly translate the security attributes. As a result, the identity of the initiator could be translated from untrusted to trusted or vice-versa. This could result in access-control bypass, privilege escalation, or denial of service.

What are the security consequences of Improper Translation of Security Attributes by Fabric Bridge?+

If exploited, CWE-1311 (Improper Translation of Security Attributes by Fabric Bridge) it can compromise Confidentiality, Integrity and Access Control, leading to outcomes such as Modify Memory, Read Memory, Gain Privileges or Assume Identity, Bypass Protection Mechanism and Execute Unauthorized Code or Commands.

How do you prevent or mitigate Improper Translation of Security Attributes by Fabric Bridge?+

Recommended mitigations for CWE-1311 include: The translation must map signals in such a way that untrusted agents cannot map to trusted agents or vice-versa. Ensure that the translation maps signals in such a way that untrusted agents cannot map to trusted agents or vice-versa.

Which programming languages are affected by Improper Translation of Security Attributes by Fabric Bridge?+

CWE-1311 commonly affects Verilog and VHDL. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-1311 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-1311: Improper Translation of Security Attributes by Fabric Bridge

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description