Improper Setting of Bus Controlling Capability in Fabric End-point

Description

Improper Setting of Bus Controlling Capability in Fabric End-point occurs when the bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric. This weakness arises when configurable register bits in fabric interfaces incorrectly allow IP blocks that should only respond to become capable of initiating transactions to other peripherals. Devices designed as responders gaining master capabilities can compromise the entire system security by accessing arbitrary memory or peripherals.

Risk

Improper bus controlling capability has severe implications. Responder devices can become masters. Unauthorized memory access enabled. Peripheral-to-peripheral attacks possible. System integrity compromised. Audio/video codecs accessing CPU memory. DMA-style attacks from unexpected sources. Protection mechanisms bypassed. Full system compromise possible. Medium to high likelihood when capability bits are not properly constrained.

Solution

Set the bus-controlling-capability register bit to 0 by default in hardware during architecture and design phase. Prevent this bit from being set during secure-boot flows. Implement access controls to block unauthorized modifications to the register. Lock the register after initial configuration. Use hardware fuses for permanent disabling in production. Verify the setting through platform firmware during boot.

Common Consequences

Impact	Details
Access Control	Scope: Access Control Responder devices can bypass intended access restrictions and initiate unauthorized transactions.
Integrity	Scope: Integrity Memory modification possible when responders gain master capability.
Confidentiality	Scope: Confidentiality Unauthorized memory reading through responder-turned-master transactions.

Example Code

Vulnerable Code

// Vulnerable: Fabric endpoint with unprotected bus-master enable

module vulnerable_fabric_endpoint (
    input  wire        clk,
    input  wire        rst_n,

    // Configuration interface
    input  wire [31:0] cfg_addr,
    input  wire [31:0] cfg_wdata,
    input  wire        cfg_write,

    // Fabric interface
    output reg         fabric_master_en,
    output reg  [31:0] fabric_addr,
    output reg  [31:0] fabric_wdata,
    output reg         fabric_write,
    output reg         fabric_read,

    // Device-specific interface
    input  wire [31:0] device_data,
    output reg  [31:0] device_addr_out,
    output reg         device_access
);

    // Configuration registers
    reg [31:0] control_reg;

    localparam CTRL_REG_ADDR = 32'h0000_0100;
    localparam BUS_MASTER_EN_BIT = 0;

    // VULNERABLE: Bus-master enable not protected
    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            // VULNERABLE: Reset value allows bus-master capability
            control_reg <= 32'h0000_0001;  // Bus master enabled by default!
        end else if (cfg_write && cfg_addr == CTRL_REG_ADDR) begin
            // VULNERABLE: Any write can modify bus-master enable
            control_reg <= cfg_wdata;
        end
    end

    // VULNERABLE: Responder can become master
    assign fabric_master_en = control_reg[BUS_MASTER_EN_BIT];

    // When bus-master enabled, device can initiate transactions
    always @(posedge clk) begin
        if (fabric_master_en) begin
            // VULNERABLE: Device can access any address
            fabric_addr <= device_addr_out;
            fabric_wdata <= device_data;
            fabric_write <= device_access;
        end
    end

    // Attack:
    // 1. Audio codec with bus-master enabled
    // 2. Malicious firmware loads attack payload into codec
    // 3. Codec initiates transactions to CPU memory
    // 4. Reads secrets or modifies critical data

endmodule

// Vulnerable: Fabric controller without endpoint restrictions
module vulnerable_fabric_controller (
    input  wire        clk,
    input  wire        rst_n,

    // Endpoint master requests
    input  wire        ep_master_req,
    input  wire [31:0] ep_master_addr,
    input  wire [31:0] ep_master_data,
    input  wire        ep_master_write,
    input  wire [3:0]  ep_id,

    // Fabric output
    output reg  [31:0] fabric_addr,
    output reg  [31:0] fabric_data,
    output reg         fabric_write,
    output reg         fabric_valid
);

    // VULNERABLE: No checking of which endpoints can be masters
    // Any endpoint can initiate transactions

    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            fabric_valid <= 1'b0;
        end else if (ep_master_req) begin
            // VULNERABLE: Blindly accepts master requests
            fabric_addr <= ep_master_addr;
            fabric_data <= ep_master_data;
            fabric_write <= ep_master_write;
            fabric_valid <= 1'b1;
        end else begin
            fabric_valid <= 1'b0;
        end
    end

    // Attack:
    // Endpoint that should only be responder can become master
    // No policy enforcement on which endpoints can master

endmodule

Fixed Code

// Fixed: Fabric endpoint with protected bus-master capability

module secure_fabric_endpoint (
    input  wire        clk,
    input  wire        rst_n,

    // Configuration interface
    input  wire [31:0] cfg_addr,
    input  wire [31:0] cfg_wdata,
    input  wire        cfg_write,
    input  wire        privileged_access,

    // Lifecycle signals
    input  wire        secure_boot_complete,
    input  wire        bus_master_fuse,      // OTP fuse for permanent disable

    // Fabric interface
    output reg         fabric_master_en,
    output reg  [31:0] fabric_addr,
    output reg  [31:0] fabric_wdata,
    output reg         fabric_write,
    output reg         fabric_read,
    output reg         config_denied,

    // Device-specific interface
    input  wire [31:0] device_data,
    output reg  [31:0] device_addr_out,
    output reg         device_access
);

    // Configuration registers
    reg [31:0] control_reg;
    reg config_locked;

    localparam CTRL_REG_ADDR = 32'h0000_0100;
    localparam BUS_MASTER_EN_BIT = 0;

    // FIXED: Lock configuration after secure boot
    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            config_locked <= 1'b0;
        end else if (secure_boot_complete) begin
            // FIXED: Lock after secure boot completes
            config_locked <= 1'b1;
        end
    end

    // FIXED: Protected bus-master configuration
    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            // FIXED: Reset to bus-master disabled (responder only)
            control_reg <= 32'h0000_0000;
            config_denied <= 1'b0;
        end else if (cfg_write && cfg_addr == CTRL_REG_ADDR) begin
            config_denied <= 1'b0;

            // FIXED: Check fuse, lock, and privilege
            if (bus_master_fuse) begin
                // FIXED: Fuse permanently disables bus-master capability
                control_reg[BUS_MASTER_EN_BIT] <= 1'b0;
                config_denied <= cfg_wdata[BUS_MASTER_EN_BIT];
            end else if (config_locked) begin
                // FIXED: Deny changes after lock
                config_denied <= 1'b1;
            end else if (!privileged_access) begin
                // FIXED: Only privileged access can enable bus-master
                control_reg <= cfg_wdata & ~(1 << BUS_MASTER_EN_BIT);
                if (cfg_wdata[BUS_MASTER_EN_BIT]) begin
                    config_denied <= 1'b1;
                end
            end else begin
                // Privileged, unlocked, no fuse - allow configuration
                control_reg <= cfg_wdata;
            end
        end
    end

    // FIXED: Bus-master capability with fuse override
    wire bus_master_allowed = control_reg[BUS_MASTER_EN_BIT] && !bus_master_fuse;
    assign fabric_master_en = bus_master_allowed;

    // FIXED: Only allow transactions when master capability is properly enabled
    always @(posedge clk) begin
        if (bus_master_allowed) begin
            fabric_addr <= device_addr_out;
            fabric_wdata <= device_data;
            fabric_write <= device_access;
        end else begin
            fabric_addr <= 32'h0;
            fabric_wdata <= 32'h0;
            fabric_write <= 1'b0;
        end
    end

endmodule

// Fixed: Fabric controller with endpoint capability enforcement
module secure_fabric_controller (
    input  wire        clk,
    input  wire        rst_n,

    // Endpoint master requests
    input  wire        ep_master_req,
    input  wire [31:0] ep_master_addr,
    input  wire [31:0] ep_master_data,
    input  wire        ep_master_write,
    input  wire [3:0]  ep_id,

    // Configuration
    input  wire [15:0] master_capable_endpoints,  // Bitmap from secure config

    // Fabric output
    output reg  [31:0] fabric_addr,
    output reg  [31:0] fabric_data,
    output reg         fabric_write,
    output reg         fabric_valid,
    output reg         master_denied
);

    // FIXED: Check if endpoint is allowed to be master
    wire endpoint_allowed = master_capable_endpoints[ep_id];

    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            fabric_valid <= 1'b0;
            master_denied <= 1'b0;
        end else begin
            master_denied <= 1'b0;

            if (ep_master_req) begin
                // FIXED: Verify endpoint has master capability
                if (endpoint_allowed) begin
                    fabric_addr <= ep_master_addr;
                    fabric_data <= ep_master_data;
                    fabric_write <= ep_master_write;
                    fabric_valid <= 1'b1;
                end else begin
                    // FIXED: Deny and log unauthorized master attempt
                    fabric_valid <= 1'b0;
                    master_denied <= 1'b1;
                end
            end else begin
                fabric_valid <= 1'b0;
            end
        end
    end

endmodule

CVE Examples

CVE-2021-0146: Hardware allows activation of test or debug logic allowing responder endpoints to gain bus-master capabilities.
CVE-2020-8703: Improper input validation in platform fabric allowed unauthorized master transactions.

CWE-284: Improper Access Control (parent)
CWE-1203: Peripherals, On-chip Fabric, and Interface/IO Problems (category)
CWE-1317: Improper Access Control in Fabric Bridge (peer)
CWE-1396: Comprehensive Categorization: Access Control (category)

References

MITRE Corporation. "CWE-1315: Improper Setting of Bus Controlling Capability in Fabric End-point." https://cwe.mitre.org/data/definitions/1315.html
ARM. "AMBA AXI Protocol Specification"
Intel. "System-on-Chip Fabric Security Guidelines"

Improper Setting of Bus Controlling Capability in Fabric End-point

Description

Risk

Solution

Common Consequences

Example Code

Vulnerable Code

Fixed Code

CVE Examples

References

Platform

Resources

Company

Latest Articles

Improper Setting of Bus Controlling Capability in Fabric End-point

Description

Risk

Solution

Common Consequences

Example Code

Vulnerable Code

Fixed Code

CVE Examples

Related CWEs

References