CWE-440: Expected Behavior Violation

How it's found

Expected Behavior Violation is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.

Vulnerable vs. safe

mie_d = (mie_q & ~mideleg_q) | (csr_wdata & mideleg_q) | utval_q;// the mideleg makes sure only delegate-able register//(and therefore also only implemented registers) are writtenriscv::CSR_SIE: beginend...unique case (csr_addr.address)...endcaseif (csr_we) beginendmodule csr_regfile #(...)(...);...// ---------------------------// CSR Write and update logic// ---------------------------...endmodule

mie_d = (mie_q & ~mideleg_q) | (csr_wdata & mideleg_q);// the mideleg makes sure only delegate-able register//(and therefore also only implemented registers) are writtenriscv::CSR_SIE: beginend...unique case (csr_addr.address)...endcaseif (csr_we) beginendmodule csr_regfile #(...)(...);...// ---------------------------// CSR Write and update logic// ---------------------------...endmodule

Consequences

• Quality Degradation, Varies by Context

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Class weakness
  CWE-684: Incorrect Provision of Specified Functionality