CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface

An asset inside a chip might have access-control
protections through one interface. However, if all paths to
the asset are not protected, an attacker might compromise
the asset through alternate paths. These alternate paths
could be through shadow or mirror registers inside the IP
core, or could be paths from other external-facing
interfaces to the IP core or SoC.

Consider an SoC with various interfaces such as UART,
SMBUS, PCIe, USB, etc. If access control is implemented for
SoC internal registers only over the PCIe interface, then
an attacker could still modify the SoC internal registers
through alternate paths by coming through interfaces such
as UART, SMBUS, USB, etc.

Alternatively, attackers might be able to bypass
existing protections by exploiting unprotected, shadow
registers. Shadow registers and mirror registers typically
refer to registers that can be accessed from multiple
addresses. Writing to or reading from the aliased/mirrored
address has the same effect as writing to the address of
the main register. They are typically implemented within an
IP core or SoC to temporarily hold certain data. These data
will later be updated to the main register, and both
registers will be in synch. If the shadow registers are not
access-protected, attackers could simply initiate
transactions to the shadow registers and compromise system
security.