CWE-1245 — Improper Finite State Machines (FSMs) in Hardware Logic
CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Incomplete |
| Likelihood of exploit | — |
Description
Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system.
The functionality and security of the system heavily depend on the implementation of FSMs. FSMs can be used to indicate the current security state of the system. Lots of secure data operations and data transfers rely on the state reported by the FSM.
Common consequences
- Availability, Access Control: Unexpected State, DoS: Crash, Exit, or Restart, DoS: Instability, Gain Privileges or Assume Identity
Mitigations
Architecture and Design — Define all possible states and handle all unused states through default statements. Ensure that system defaults to a secure state.
References
- CWE page: https://cwe.mitre.org/data/definitions/1245.html
- CWE list: https://cwe.mitre.org/data/index.html