CWE-1298: Hardware Logic Contains Race Conditions
A race condition in the hardware logic results in undermining security guarantees of the system.
How it's found
Hardware Logic Contains Race Conditions is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
A race condition in logic circuits typically occurs when a logic gate gets inputs from signals that have traversed different paths while originating from the same source. Such inputs to the gate can change at slightly different times in response to a change in the source signal. This results in a timing error or a glitch (temporary or permanent) that causes the output to change to an unwanted state before settling back to the desired state. If such timing errors occur in access control logic or finite state machines that are implemented in security sensitive flows, an attacker might exploit them to circumvent existing protections.
Vulnerable vs. safe
input wire in0, in1, sel,output wire z// 2x1 Multiplexor using logic-gatesmodule glitchEx();wire not_sel;wire and_out1, and_out2;assign not_sel = ~sel;assign and_out1 = not_sel & in0;assign and_out2 = sel & in1;// Buggy line of code:assign z = and_out1 | and_out2; // glitch in signal zendmoduleassign z <= and_out1 or and_out2 or (in0 and in1);Consequences
- Bypass Protection Mechanism, Gain Privileges or Assume Identity, Alter Execution Logic
Mitigations
- Architecture and Design: Adopting design practices that encourage designers to recognize and eliminate race conditions, such as Karnaugh maps, could result in the decrease in occurrences of race conditions.
- Implementation: Logic redundancy can be implemented along security critical paths to prevent race conditions. To avoid metastability, it is a good practice in general to default to a secure state in which access is not given to untrusted agents.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-1298?
A race condition in the hardware logic results in undermining security guarantees of the system.
How do you find Hardware Logic Contains Race Conditions?
Hardware Logic Contains Race Conditions is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-1298?
Bypass Protection Mechanism, Gain Privileges or Assume Identity, Alter Execution Logic
Does TurboPentest test for Hardware Logic Contains Race Conditions?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest