CWE-1302 Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)

The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity, but the entity does not consistently include the necessary Security Identifier with a security-critical transaction.

• Confidentiality, Integrity, Availability, Access Control: Modify Memory, Read Memory, DoS: Crash, Exit, or Restart, Bypass Protection Mechanism, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands — If the Security Identifier is missing, the destination agent might drop the message (resulting in an inadvertent Denial-of-Service (DoS)) or take inappropriate action by default in its attempt to execute the transaction, resulting in privilege escalation or provision of unintended access.

• [Architecture and Design] Transaction details must be reviewed for design inconsistency and common weaknesses. • [Implementation] Security identifier definition and programming flow must be tested in pre-silicon and post-silicon testing.