CWE-1326: Missing Immutable Root of Trust in Hardware

What is Missing Immutable Root of Trust in Hardware?

• Overview: A missing immutable root of trust in hardware is a vulnerability where the hardware lacks a secure and unchangeable foundation to verify and authenticate boot code. This absence allows attackers to bypass secure boot processes or execute unauthorized code.

• Exploitation Methods:

• Attackers can modify boot code or the public key verifying the boot code if it is stored in mutable memory.
• Common attack patterns include tampering with system-hardware settings, such as disabling secure boot, to gain control over the boot process.

• Security Impact:

• Direct consequences include the execution of unauthorized or malicious code during the boot process.
• Potential cascading effects involve further system compromise, allowing attackers to maintain persistent access or deploy malware.
• Business impact can be severe, leading to data breaches, loss of customer trust, and potential regulatory penalties.

• Prevention Guidelines:

• Ensure that the root of trust is stored in immutable memory, such as ROM, which is locked after provisioning.
• Implement security best practices including enabling secure boot and ensuring it cannot be disabled without authorization.
• Use tools and frameworks that support secure boot processes and provide mechanisms for authenticated updates, such as secure bootloaders and trusted platform modules (TPMs).

Corgea can automatically detect and fix Missing Immutable Root of Trust in Hardware in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not Language-Specific

Affected Technologies: Security Hardware, Not Technology-Specific

Vulnerable Code Example

# Vulnerable code with detailed comments explaining the security issue
class FirmwareLoader:
    def __init__(self, firmware_path):
        self.firmware_path = firmware_path

    def load_firmware(self):
        # Directly load firmware without verifying its integrity
        with open(self.firmware_path, 'rb') as firmware_file:
            firmware_data = firmware_file.read()
        # Execute firmware (potentially untrusted code)
        exec(firmware_data)  # This allows execution of potentially malicious code

Explanation of Vulnerability

The code above demonstrates a missing immutable root of trust. The FirmwareLoader class directly loads and executes firmware from a file path without verifying its integrity or origin. This can lead to executing untrusted or malicious code, bypassing secure boot mechanisms. The absence of a verification step means that any code, including potentially harmful code, can be executed, which is a significant security risk.

How to fix Missing Immutable Root of Trust in Hardware?

To fix this vulnerability, we need to establish a root of trust by verifying the integrity and authenticity of the firmware before execution. This can be accomplished by using cryptographic signatures. The firmware should be signed by a trusted authority, and the loader should verify this signature before loading the firmware.

Steps to fix:

1. Use Cryptographic Signatures: Ensure that firmware is signed using a strong cryptographic algorithm.
2. Verify Signature: Before executing the firmware, verify its signature using a public key that is embedded in a secure, immutable location.
3. Reject Unsigned or Mismatched Signatures: If the signature verification fails, do not load or execute the firmware.

Fixed Code Example

from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding, rsa
from cryptography.hazmat.primitives import serialization

class FirmwareLoader:
    def __init__(self, firmware_path, public_key_path):
        self.firmware_path = firmware_path
        self.public_key_path = public_key_path

    def load_firmware(self):
        # Load the public key from a secure, immutable location
        with open(self.public_key_path, 'rb') as key_file:
            public_key = serialization.load_pem_public_key(key_file.read())

        # Read firmware and its signature
        with open(self.firmware_path, 'rb') as firmware_file:
            firmware_data = firmware_file.read()
        
        # Assuming the signature is the first 256 bytes
        signature = firmware_data[:256]
        firmware_code = firmware_data[256:]

        # Verify the firmware signature
        try:
            public_key.verify(
                signature,
                firmware_code,
                padding.PKCS1v15(),
                hashes.SHA256()
            )
            # Execute the firmware only if the signature is valid
            exec(firmware_code)  # Now secure with signature verification
        except Exception as e:
            print("Invalid firmware signature. Aborting execution.")  # Reject invalid firmware

Explanation of Fix

The fixed code implements signature verification for the firmware. It uses a public key to verify the signature of the firmware data before executing it. The public key should be stored securely and be immutable to ensure the root of trust is maintained. This prevents the execution of malicious or unauthorized firmware by verifying its integrity and authenticity. By embedding the public key in a secure location and ensuring the signature matches, we establish a trust chain that mitigates the risk of executing compromised firmware.