Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
CWE-1189
The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents.
A System-On-a-Chip (SoC) has a lot of functionality, but it may have a limited number of pins or pads. A pin can only perform one function at a time. However, it can be configured to perform multiple different functions. This technique is called pin multiplexing. Similarly, several resources on the chip may be shared to multiplex and support different features or functions. When such resources are shared between trusted and untrusted agents, untrusted agents may be able to access the assets intended to be accessed only by the trusted agents.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.7.
How this weakness is prevented
- Architecture and Design: When sharing resources, avoid mixing agents of varying trust levels. Untrusted agents should not share resources with trusted agents.
Latest Improper Isolation of Shared Resources on System-on-a-Chip (SoC) vulnerabilities
- 8.7 High severity
aws-network-policy-agent: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-located pods via eBPF conntr
- 7.0 High severity
AMD EPYC™ 7002 Series Processors: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.
- 7.2 High severity
AMD Ryzen™ 8000 Series Desktop Processors: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
Improper isolation of shared resources on System-on-a-chip (SOC) could a privileged attacker to tamper with the contents of the PSP reserved DRAM region potentially resulting in loss of confidentiality and integrity.
- 7.8 High severity
Intel(R) Processors stream cache mechanism: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
Improper isolation in some Intel(R) Processors stream cache mechanism may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) Core(TM) Ultra Processor stream cache…: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
Improper isolation in the Intel(R) Core(TM) Ultra Processor stream cache mechanism may allow an authenticated user to potentially enable escalation of privilege via local access.