HR001117S0023_SSITH_Attachment3_CWEGlossary.pdf

System Security Integrated Through Hardware and firmware (SSITH) BAA

Common Weakness Enumeration (CWE) Hardware Vulnerability Glossary

ATTACHMENT 3

1) Buffer Errors

This vulnerability allows inappropriate read and/or write access to locations within memory associated with variables, data structures or internal program data. Inappropriate access to memory is exploited to subvert the normal hardware operations creating security vulnerability in the hardware.

2) Permission, Privileges and Access Control

This vulnerability allows execution of unauthorized operations in a system. A privilege vulnerability can allow inappropriate access to system privileges. A permission vulnerability can allow inappropriate permission to perform functions. An access vulnerability can allow inappropriate control of the authorizing policies for the hardware.

3) Resource Management

This vulnerability allows improper use of the hardware resources that in turn allow external takeover of hardware resources. This includes improper access to hardware resources such as memory, cpu, and communication and/or preventing valid users from gaining access to these resources.

4) Code Injection

This vulnerability allows inappropriate code to be injected into the hardware due to an inherent vulnerability in the hardware. This vulnerability allows introduction of malicious code to change the course of execution on the hardware.

5) Information Leakage (also known as Information Exposure)

This vulnerability allows inappropriate access to privileged information in the hardware through intentional or unintentional information sharing. This vulnerability includes inappropriate data transfers, caching mechanisms, and error handling but are not limited to these areas.

6) Crypto Errors

This vulnerability allows inappropriate use and execution of cryptography in hardware. This vulnerability includes inappropriate access to cryptographic keys and inappropriate use of these keys to exfiltrate information or allow inappropriate access to hardware.

7) Numeric Errors

This vulnerability allows exploitation of improper calculation or conversion of numbers and numeric types. Improper/incorrect calculations can allow subversion of security critical operational decisions and/or resource management.