Weakness (CWE)
CWE-1259: Improper Restriction of Security Token Assignment
The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected, such as improperly restricting the assignment to trusted components.
How to prevent it (1 mitigation)
-
Architecture and Design, Implementation
Since the Security Tokens are integral for the maintenance of security in an SoC, they need to be protected properly.
- Security Token assignment review checks for design inconsistency and common weaknesses.
- Security-Token definition and programming flow is tested in both pre-silicon and post-silicon testing.
Source: MITRE CWE-1259
2 results · Clear filters · Feed
-
Low 2.0
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in anoth…
-
Low 3.0
biscuit-java vulnerable to public key confusion in third party block
biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock re…