CWE-1326 Missing Immutable Root of Trust in Hardware

A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.

• Authentication, Authorization: Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands, Modify Memory — If the memory contents (i.e., RoT) are mutable, then an adversary can modify the RoT to execute their choice of code, resulting in a compromised secure boot.

• [Architecture and Design] When architecting the system, the RoT should be designated for storage in a memory that does not allow further programming/writes. Note that, for components like ROM, secure patching/update features should be supported to allow authenticated and authorized updates in the field. • [Implementation] During implementation and test, the RoT memory location should be demonstrated to not allow further programming/writes.

• Automated Dynamic Analysis: Automated testing can verify that RoT components are immutable. • Architecture or Design Review: Root of trust elements and memory should be part of architecture and design reviews.