Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)

Description

Missing Source Identifier in Entity Transactions on a System-On-Chip occurs when a product implements a security identifier mechanism but sends transactions without a security identifier. In SoC environments, transactions originate from integrated circuits and hardware engines to access assets or perform actions. These transactions typically include source identity, destination identity, and security identifiers that help destination agents determine which actions are permitted. When source agents do not consistently include the necessary Security Identifier with the transaction, destination agents may either drop messages (causing denial-of-service) or take inappropriate default actions, resulting in privilege escalation or unintended access.

Risk

Missing security identifiers have severe implications. Memory modification possible. Unauthorized reads enabled. System crashes from rejected transactions. Protection mechanisms bypassed. Unauthorized code execution. Privilege escalation through default actions. Denial of service when transactions dropped. High likelihood of exploitation when identifiers are omitted.

Solution

Review transaction details for design inconsistencies and common weaknesses during architecture and design phase. Ensure all transaction sources include appropriate security identifiers. Test security identifier definition and programming flow during pre-silicon and post-silicon testing. Implement default-deny policies for transactions without identifiers. Validate identifier presence at destination agents.

Common Consequences

Impact	Details
Confidentiality	Scope: Confidentiality Unauthorized read access when identifier missing allows default access.
Integrity	Scope: Integrity Memory modification through transactions without proper identification.
Availability	Scope: Availability Denial of service when transactions are dropped due to missing identifiers.
Access Control	Scope: Access Control Protection bypass, privilege escalation through inappropriate defaults.

Example Code

Vulnerable Code

// Vulnerable: Transaction source without security identifier

module vulnerable_transaction_source (
    input  wire        clk,
    input  wire        rst_n,
    input  wire        request,
    input  wire [31:0] address,
    input  wire [31:0] write_data,
    input  wire        write_enable,

    // Transaction bus outputs
    output reg  [31:0] bus_addr,
    output reg  [31:0] bus_data,
    output reg         bus_write,
    output reg         bus_valid
    // VULNERABLE: No security identifier output!
);

    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            bus_addr <= 32'b0;
            bus_data <= 32'b0;
            bus_write <= 1'b0;
            bus_valid <= 1'b0;
        end else if (request) begin
            bus_addr <= address;
            bus_data <= write_data;
            bus_write <= write_enable;
            bus_valid <= 1'b1;
            // VULNERABLE: Security identifier not sent with transaction
            // Destination doesn't know who is making the request
        end else begin
            bus_valid <= 1'b0;
        end
    end

endmodule

// Vulnerable: Destination accepts transactions without identifier
module vulnerable_aes_key_register (
    input  wire        clk,
    input  wire        rst_n,
    input  wire [31:0] bus_addr,
    input  wire [31:0] bus_data,
    input  wire        bus_write,
    input  wire        bus_valid,
    // VULNERABLE: No security identifier input
    output reg  [127:0] aes_key,
    output reg         access_granted
);

    localparam AES_KEY_ADDR = 32'h0000_F000;
    localparam REQUIRED_SECURITY_ID = 8'h02;  // Required but not checked!

    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            aes_key <= 128'b0;
            access_granted <= 1'b0;
        end else if (bus_valid && bus_write) begin
            if (bus_addr == AES_KEY_ADDR) begin
                // VULNERABLE: No security identifier to check!
                // Either rejects all (DoS) or accepts all (privilege escalation)

                // Option 1: Default accept (VULNERABLE)
                aes_key[31:0] <= bus_data;
                access_granted <= 1'b1;

                // Option 2: Default reject (DoS for legitimate requests)
                // access_granted <= 1'b0;
            end
        end
    end

endmodule

// Vulnerable: DMA engine missing security identifier
module vulnerable_dma_engine (
    input  wire        clk,
    input  wire        rst_n,
    input  wire        start_transfer,
    input  wire [31:0] src_addr,
    input  wire [31:0] dst_addr,
    input  wire [15:0] length,

    // Memory interface
    output reg  [31:0] mem_addr,
    output reg  [31:0] mem_data,
    output reg         mem_read,
    output reg         mem_write
    // VULNERABLE: No security_id output
);

    reg [15:0] byte_counter;
    reg transferring;

    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            mem_addr <= 32'b0;
            mem_read <= 1'b0;
            mem_write <= 1'b0;
            transferring <= 1'b0;
        end else if (start_transfer && !transferring) begin
            transferring <= 1'b1;
            byte_counter <= 16'b0;
        end else if (transferring) begin
            // VULNERABLE: DMA transactions have no security identifier
            // Memory controller can't determine if DMA should have access
            // Could be exploited to access protected memory

            mem_addr <= src_addr + byte_counter;
            mem_read <= 1'b1;

            // Transfer continues without identity...
        end
    end

endmodule

Fixed Code

// Fixed: Transaction source with security identifier

module secure_transaction_source #(
    parameter SECURITY_ID = 8'h02  // Configurable security level
) (
    input  wire        clk,
    input  wire        rst_n,
    input  wire        request,
    input  wire [31:0] address,
    input  wire [31:0] write_data,
    input  wire        write_enable,

    // Transaction bus outputs
    output reg  [31:0] bus_addr,
    output reg  [31:0] bus_data,
    output reg         bus_write,
    output reg         bus_valid,
    output reg  [7:0]  bus_security_id  // FIXED: Security identifier output
);

    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            bus_addr <= 32'b0;
            bus_data <= 32'b0;
            bus_write <= 1'b0;
            bus_valid <= 1'b0;
            bus_security_id <= 8'b0;
        end else if (request) begin
            bus_addr <= address;
            bus_data <= write_data;
            bus_write <= write_enable;
            bus_valid <= 1'b1;
            // FIXED: Include security identifier with every transaction
            bus_security_id <= SECURITY_ID;
        end else begin
            bus_valid <= 1'b0;
            bus_security_id <= 8'b0;
        end
    end

endmodule

// Fixed: Destination validates security identifier
module secure_aes_key_register (
    input  wire        clk,
    input  wire        rst_n,
    input  wire [31:0] bus_addr,
    input  wire [31:0] bus_data,
    input  wire        bus_write,
    input  wire        bus_valid,
    input  wire [7:0]  bus_security_id,  // FIXED: Security identifier input
    output reg  [127:0] aes_key,
    output reg         access_granted,
    output reg         access_denied
);

    localparam AES_KEY_ADDR = 32'h0000_F000;
    localparam REQUIRED_SECURITY_ID = 8'h02;

    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            aes_key <= 128'b0;
            access_granted <= 1'b0;
            access_denied <= 1'b0;
        end else begin
            access_granted <= 1'b0;
            access_denied <= 1'b0;

            if (bus_valid && bus_write) begin
                if (bus_addr == AES_KEY_ADDR) begin
                    // FIXED: Check security identifier is present and valid
                    if (bus_security_id == 8'b0) begin
                        // FIXED: Reject transactions without identifier
                        access_denied <= 1'b1;
                        // Log security event
                    end else if (bus_security_id >= REQUIRED_SECURITY_ID) begin
                        // FIXED: Proper authorization check
                        aes_key[31:0] <= bus_data;
                        access_granted <= 1'b1;
                    end else begin
                        // FIXED: Insufficient privilege
                        access_denied <= 1'b1;
                    end
                end
            end
        end
    end

endmodule

// Fixed: DMA engine with security identifier
module secure_dma_engine #(
    parameter DMA_SECURITY_ID = 8'h01  // DMA's security level
) (
    input  wire        clk,
    input  wire        rst_n,
    input  wire        start_transfer,
    input  wire [31:0] src_addr,
    input  wire [31:0] dst_addr,
    input  wire [15:0] length,
    input  wire [7:0]  requestor_security_id,  // FIXED: Who requested the DMA

    // Memory interface
    output reg  [31:0] mem_addr,
    output reg  [31:0] mem_data,
    output reg         mem_read,
    output reg         mem_write,
    output reg  [7:0]  mem_security_id  // FIXED: Security ID for memory access
);

    reg [15:0] byte_counter;
    reg transferring;
    reg [7:0] active_security_id;

    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            mem_addr <= 32'b0;
            mem_read <= 1'b0;
            mem_write <= 1'b0;
            mem_security_id <= 8'b0;
            transferring <= 1'b0;
            active_security_id <= 8'b0;
        end else if (start_transfer && !transferring) begin
            transferring <= 1'b1;
            byte_counter <= 16'b0;
            // FIXED: Use minimum of DMA and requestor security level
            // DMA can't grant more access than the requestor has
            active_security_id <= (requestor_security_id < DMA_SECURITY_ID) ?
                                   requestor_security_id : DMA_SECURITY_ID;
        end else if (transferring) begin
            // FIXED: Include security identifier with DMA transactions
            mem_addr <= src_addr + byte_counter;
            mem_read <= 1'b1;
            mem_security_id <= active_security_id;  // FIXED: Proper identity

            // Memory controller can now enforce access control
        end else begin
            mem_security_id <= 8'b0;
        end
    end

endmodule

// Fixed: Bus interconnect that validates identifier presence
module secure_bus_interconnect (
    input  wire        clk,
    input  wire        rst_n,

    // Source interface
    input  wire [31:0] src_addr,
    input  wire [31:0] src_data,
    input  wire        src_write,
    input  wire        src_valid,
    input  wire [7:0]  src_security_id,

    // Destination interface
    output reg  [31:0] dst_addr,
    output reg  [31:0] dst_data,
    output reg         dst_write,
    output reg         dst_valid,
    output reg  [7:0]  dst_security_id,

    // Error signals
    output reg         missing_id_error
);

    always @(posedge clk or negedge rst_n) begin
        if (!rst_n) begin
            dst_valid <= 1'b0;
            missing_id_error <= 1'b0;
        end else if (src_valid) begin
            // FIXED: Validate security identifier is present
            if (src_security_id == 8'b0) begin
                // FIXED: Block transactions without identifier
                dst_valid <= 1'b0;
                missing_id_error <= 1'b1;

                // Log the violation for security monitoring
            end else begin
                // FIXED: Forward valid transaction with identifier
                dst_addr <= src_addr;
                dst_data <= src_data;
                dst_write <= src_write;
                dst_valid <= 1'b1;
                dst_security_id <= src_security_id;
                missing_id_error <= 1'b0;
            end
        end else begin
            dst_valid <= 1'b0;
            missing_id_error <= 1'b0;
        end
    end

endmodule

CVE Examples

CVE-2021-0146: Missing security identifier in certain Intel processors allowed privilege escalation through bus transactions.
CVE-2020-8705: SoC transactions without proper identification enabled unauthorized access.

CWE-1294: Insecure Security Identifier Mechanism (parent)
CWE-1198: Privilege Separation and Access Control Issues (category)
CWE-1290: Incorrect Decoding of Security Identifiers (related)
CWE-862: Missing Authorization (related)

References

MITRE Corporation. "CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)." https://cwe.mitre.org/data/definitions/1302.html
ARM. "AMBA Protocol Security Extensions"
RISC-V. "Physical Memory Protection (PMP) Specification"

Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)

Description

Risk

Solution

Common Consequences

Example Code

Vulnerable Code

Fixed Code

CVE Examples

References

Cyber Security Consulting

Industries

Company

Recent Posts

Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)

Description

Risk

Solution

Common Consequences

Example Code

Vulnerable Code

Fixed Code

CVE Examples

Related CWEs

References