CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy
An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode.
View on MITREExtended Description
To ensure the performance and functional reliability of certain components, hardware designers can implement hardware blocks for redundancy in the case that others fail. This redundant block can be prevented from performing as intended if the design allows unauthorized agents to inject errors into it. In this way, a path with injected errors may become unavailable to serve as a redundant channel. This may put the system into a degraded mode of operation which could be exploited by a subsequent attack.
Technical Details
- Structure
- Simple
Applicable To
Security Consequences
Scope
Impact
Mitigation Strategies
Phase
Description
Ensure the design does not allow error injection in modes intended for normal run-time operation. Provide access controls on interfaces for injecting errors.
Phase
Description
Disallow error injection in modes which are expected to be used for normal run-time operation. Provide access controls on interfaces for injecting errors.
Phase
Description
Add an access control layer atop any unprotected interfaces for injecting errors.
Detection Methods
No detection method information available for this CWE.
Code Examples & CVEs
No examples or observed CVEs available for this CWE.
CWE Relationships
No relationship information available for this CWE.
Frequently Asked Questions
What is CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy?+
CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy is a Common Weakness Enumeration (CWE) entry maintained by MITRE. An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode. To ensure the performance and functional reliability of certain components, hardware designers can implement hardware blocks for redundancy in the case that others fail. This redundant block can be prevented from performing as intended if the design allows unauthorized agents to inject errors into it. In this way, a path with injected errors may become unavailable to serve as a redundant channel. This may put the system into a degraded mode of operation which could be exploited by a subsequent attack.
What are the security consequences of Unauthorized Error Injection Can Degrade Hardware Redundancy?+
If exploited, CWE-1334 (Unauthorized Error Injection Can Degrade Hardware Redundancy) it can compromise Integrity and Availability, leading to outcomes such as DoS: Crash, Exit, or Restart, DoS: Instability, Quality Degradation, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory) and DoS: Resource Consumption (Other).
How do you prevent or mitigate Unauthorized Error Injection Can Degrade Hardware Redundancy?+
Recommended mitigations for CWE-1334 include: Ensure the design does not allow error injection in modes intended for normal run-time operation. Provide access controls on interfaces for injecting errors. Disallow error injection in modes which are expected to be used for normal run-time operation. Provide access controls on interfaces for injecting errors. Add an access control layer atop any unprotected interfaces for injecting errors.
Which programming languages are affected by Unauthorized Error Injection Can Degrade Hardware Redundancy?+
CWE-1334 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-1334 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.