CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic
Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system.
How it's found
Improper Finite State Machines (FSMs) in Hardware Logic is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
The functionality and security of the system heavily depend on the implementation of FSMs. FSMs can be used to indicate the current security state of the system. Lots of secure data operations and data transfers rely on the state reported by the FSM.
Vulnerable vs. safe
state = 3'h0;
3'h0:3'h1:3'h2:3'h3: state = 2'h3;3'h4: state = 2'h2;3'h5: state = 2'h1;if (!rst_n)elsecase (user_input)endcasebeginendout <= {1'h1, state};module fsm_1(out, user_input, clk, rst_n);input [2:0] user_input;input clk, rst_n;output reg [2:0] out;reg [1:0] state;always @ (posedge clk or negedge rst_n )endmoduledefault: state = 2'h0;3'h0:3'h1:3'h2:3'h3: state = 2'h3;3'h4: state = 2'h2;3'h5: state = 2'h1;case (user_input)endcaseConsequences
- Unexpected State, DoS: Crash, Exit, or Restart, DoS: Instability, Gain Privileges or Assume Identity: Faulty FSM designs that do not account for all states, either through undefined states (left as don't cares) or through incorrect implementation, might lead an attacker to drive the system into an unstable state from which the system cannot recover without a reset, thus causing a DoS. Depending on what the FSM is used for, an attacker might also gain additional privileges to launch further attacks and compromise the security guarantees.
Mitigations
- Architecture and Design/Implementation: Define all possible states and handle all unused states through default statements. Ensure that system defaults to a secure state.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-1245?
Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system.
How do you find Improper Finite State Machines (FSMs) in Hardware Logic?
Improper Finite State Machines (FSMs) in Hardware Logic is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-1245?
Unexpected State, DoS: Crash, Exit, or Restart, DoS: Instability, Gain Privileges or Assume Identity: Faulty FSM designs that do not account for all states, either through undefined states (left as don't cares) or through incorrect implementation, might lead an attacker to drive the system into an unstable state from which the system cannot recover without a reset, thus causing a DoS. Depending on what the FSM is used for, an attacker might also gain additional privileges to launch further attacks and compromise the security guarantees.
Does TurboPentest test for Improper Finite State Machines (FSMs) in Hardware Logic?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest