Weakness (CWE)
CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior
Specific combinations of processor instructions lead to undesirable behavior such as locking the processor until a hard reset performed.
More detail
If the instruction set architecture (ISA) and processor logic are not designed carefully and tested thoroughly, certain combinations of instructions may lead to locking the processor or other unexpected and undesirable behavior. Upon encountering unimplemented instruction opcodes or illegal instruction operands, the processor should throw an exception and carry on without negatively impacting security. However, specific combinations of legal and illegal instructions may cause unexpected behavior with security implications such as allowing unprivileged programs to completely lock the CPU.
How to prevent it (2 mitigations)
-
Testing
Implement a rigorous testing strategy that incorporates randomization to explore instruction sequences that are unlikely to appear in normal workloads in order to identify halt and catch fire instruction sequences.
-
Patching and Maintenance
Patch operating system to avoid running Halt and Catch Fire type sequences or to mitigate the damage caused by unexpected behavior. See [REF-1108].
Source: MITRE CWE-1281
2 results · Clear filters · Feed
-
Medium 6.5
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys…
-
Medium 4.7
Sequence of processor instructions leads to unexpected behavior in Intel(R) Core(TM) Ultra Processors may allow an auth…