CWE-1298: Hardware Logic Contains Race Conditions

How it's found

Hardware Logic Contains Race Conditions is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.

A race condition in logic circuits typically occurs when a logic gate gets inputs from signals that have traversed different paths while originating from the same source. Such inputs to the gate can change at slightly different times in response to a change in the source signal. This results in a timing error or a glitch (temporary or permanent) that causes the output to change to an unwanted state before settling back to the desired state. If such timing errors occur in access control logic or finite state machines that are implemented in security sensitive flows, an attacker might exploit them to circumvent existing protections.

Vulnerable vs. safe

input wire in0, in1, sel,output wire z// 2x1 Multiplexor using logic-gatesmodule glitchEx();wire not_sel;wire and_out1, and_out2;assign not_sel = ~sel;assign and_out1 = not_sel & in0;assign and_out2 = sel & in1;// Buggy line of code:assign z = and_out1 | and_out2; // glitch in signal zendmodule

assign z <= and_out1 or and_out2 or (in0 and in1);

Consequences

• Bypass Protection Mechanism, Gain Privileges or Assume Identity, Alter Execution Logic

Mitigations

• Architecture and Design: Adopting design practices that encourage designers to recognize and eliminate race conditions, such as Karnaugh maps, could result in the decrease in occurrences of race conditions.
• Implementation: Logic redundancy can be implemented along security critical paths to prevent race conditions. To avoid metastability, it is a good practice in general to default to a secure state in which access is not given to untrusted agents.

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Class weakness
  CWE-362: Race Condition