blob: 940cad54f7f951ed667e8e098e93a62631ea5a55 [file] [log] [blame]
Gary Morrisond4d951a2021-11-10 14:40:15 -06001Generic Threat Model
Olivier Deprez86d1ffd2021-06-01 15:37:16 +02002********************
Zelalem05fed522021-02-24 19:20:09 -06003
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +02004************
Olivier Deprez86d1ffd2021-06-01 15:37:16 +02005Introduction
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +02006************
7
Olivier Deprez86d1ffd2021-06-01 15:37:16 +02008This document provides a generic threat model for TF-A firmware.
Zelalem05fed522021-02-24 19:20:09 -06009
Zelalem Aweke023b1a42021-10-21 13:59:45 -050010.. note::
11
12 This threat model doesn't consider Root and Realm worlds introduced by
13 :ref:`Realm Management Extension (RME)`.
14
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +020015********************
Zelalem05fed522021-02-24 19:20:09 -060016Target of Evaluation
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +020017********************
18
Zelalem05fed522021-02-24 19:20:09 -060019In this threat model, the target of evaluation is the Trusted
20Firmware for A-class Processors (TF-A). This includes the boot ROM (BL1),
21the trusted boot firmware (BL2) and the runtime EL3 firmware (BL31) as
22shown on Figure 1. Everything else on Figure 1 is outside of the scope of
23the evaluation.
24
25TF-A can be configured in various ways. In this threat model we consider
26only the most basic configuration. To that end we make the following
27assumptions:
28
29- All TF-A images are run from either ROM or on-chip trusted SRAM. This means
30 TF-A is not vulnerable to an attacker that can probe or tamper with off-chip
31 memory.
Zelalem Aweke023b1a42021-10-21 13:59:45 -050032
Zelalem05fed522021-02-24 19:20:09 -060033- Trusted boot is enabled. This means an attacker can't boot arbitrary images
34 that are not approved by platform providers.
Zelalem Aweke023b1a42021-10-21 13:59:45 -050035
Zelalem05fed522021-02-24 19:20:09 -060036- There is no Secure-EL2. We don't consider threats that may come with
37 Secure-EL2 software.
38
Sandrine Bailleuxbe8b6542022-05-16 15:10:27 +020039- Measured boot is disabled. We do not consider the threats nor the mitigations
40 that may come with it.
41
Sandrine Bailleux78cdfdd2022-05-12 14:57:26 +020042- No experimental features are enabled. We do not consider threats that may come
43 from them.
44
Zelalem05fed522021-02-24 19:20:09 -060045Data Flow Diagram
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +020046=================
47
Zelalem05fed522021-02-24 19:20:09 -060048Figure 1 shows a high-level data flow diagram for TF-A. The diagram
49shows a model of the different components of a TF-A-based system and
50their interactions with TF-A. A description of each diagram element
51is given on Table 1. On the diagram, the red broken lines indicate
52trust boundaries. Components outside of the broken lines
53are considered untrusted by TF-A.
54
55.. uml:: ../resources/diagrams/plantuml/tfa_dfd.puml
56 :caption: Figure 1: TF-A Data Flow Diagram
57
58.. table:: Table 1: TF-A Data Flow Diagram Description
59
60 +-----------------+--------------------------------------------------------+
61 | Diagram Element | Description |
62 +=================+========================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +020063 | DF1 | | At boot time, images are loaded from non-volatile |
Zelalem05fed522021-02-24 19:20:09 -060064 | | memory and verified by TF-A boot firmware. These |
65 | | images include TF-A BL2 and BL31 images, as well as |
66 | | other secure and non-secure images. |
67 +-----------------+--------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +020068 | DF2 | | TF-A log system framework outputs debug messages |
Zelalem05fed522021-02-24 19:20:09 -060069 | | over a UART interface. |
70 +-----------------+--------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +020071 | DF3 | | Debug and trace IP on a platform can allow access |
Zelalem05fed522021-02-24 19:20:09 -060072 | | to registers and memory of TF-A. |
73 +-----------------+--------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +020074 | DF4 | | Secure world software (e.g. trusted OS) interact |
Zelalem05fed522021-02-24 19:20:09 -060075 | | with TF-A through SMC call interface and/or shared |
76 | | memory. |
77 +-----------------+--------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +020078 | DF5 | | Non-secure world software (e.g. rich OS) interact |
Zelalem05fed522021-02-24 19:20:09 -060079 | | with TF-A through SMC call interface and/or shared |
80 | | memory. |
81 +-----------------+--------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +020082 | DF6 | | This path represents the interaction between TF-A and|
Zelalem05fed522021-02-24 19:20:09 -060083 | | various hardware IPs such as TrustZone controller |
84 | | and GIC. At boot time TF-A configures/initializes the|
85 | | IPs and interacts with them at runtime through |
86 | | interrupts and registers. |
87 +-----------------+--------------------------------------------------------+
88
89
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +020090***************
Zelalem05fed522021-02-24 19:20:09 -060091Threat Analysis
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +020092***************
93
Zelalem05fed522021-02-24 19:20:09 -060094In this section we identify and provide assessment of potential threats to TF-A
95firmware. The threats are identified for each diagram element on the
96data flow diagram above.
97
98For each threat, we identify the *asset* that is under threat, the
99*threat agent* and the *threat type*. Each threat is given a *risk rating*
100that represents the impact and likelihood of that threat. We also discuss
101potential mitigations.
102
103Assets
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200104======
105
Zelalem05fed522021-02-24 19:20:09 -0600106We have identified the following assets for TF-A:
107
108.. table:: Table 2: TF-A Assets
109
110 +--------------------+---------------------------------------------------+
111 | Asset | Description |
112 +====================+===================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200113 | Sensitive Data | | These include sensitive data that an attacker |
Zelalem05fed522021-02-24 19:20:09 -0600114 | | must not be able to tamper with (e.g. the Root |
115 | | of Trust Public Key) or see (e.g. secure logs, |
116 | | debugging information such as crash reports). |
117 +--------------------+---------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200118 | Code Execution | | This represents the requirement that the |
Zelalem05fed522021-02-24 19:20:09 -0600119 | | platform should run only TF-A code approved by |
120 | | the platform provider. |
121 +--------------------+---------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200122 | Availability | | This represents the requirement that TF-A |
Zelalem05fed522021-02-24 19:20:09 -0600123 | | services should always be available for use. |
124 +--------------------+---------------------------------------------------+
125
126Threat Agents
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200127=============
128
Zelalem05fed522021-02-24 19:20:09 -0600129To understand the attack surface, it is important to identify potential
130attackers, i.e. attack entry points. The following threat agents are
131in scope of this threat model.
132
133.. table:: Table 3: Threat Agents
134
135 +-------------------+-------------------------------------------------------+
136 | Threat Agent | Description |
137 +===================+=======================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200138 | NSCode | | Malicious or faulty code running in the Non-secure |
Zelalem05fed522021-02-24 19:20:09 -0600139 | | world, including NS-EL0 NS-EL1 and NS-EL2 levels |
140 +-------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200141 | SecCode | | Malicious or faulty code running in the secure |
Zelalem05fed522021-02-24 19:20:09 -0600142 | | world, including S-EL0 and S-EL1 levels |
143 +-------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200144 | AppDebug | | Physical attacker using debug signals to access |
Zelalem05fed522021-02-24 19:20:09 -0600145 | | TF-A resources |
146 +-------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200147 | PhysicalAccess | | Physical attacker having access to external device |
Zelalem05fed522021-02-24 19:20:09 -0600148 | | communication bus and to external flash |
149 | | communication bus using common hardware |
150 +-------------------+-------------------------------------------------------+
151
152.. note::
153
154 In this threat model an advanced physical attacker that has the capability
155 to tamper with a hardware (e.g. "rewiring" a chip using a focused
156 ion beam (FIB) workstation or decapsulate the chip using chemicals) is
157 considered out-of-scope.
158
159Threat Types
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200160============
161
Zelalem05fed522021-02-24 19:20:09 -0600162In this threat model we categorize threats using the `STRIDE threat
163analysis technique`_. In this technique a threat is categorized as one
164or more of these types: ``Spoofing``, ``Tampering``, ``Repudiation``,
165``Information disclosure``, ``Denial of service`` or
166``Elevation of privilege``.
167
168Threat Risk Ratings
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200169===================
170
Zelalem05fed522021-02-24 19:20:09 -0600171For each threat identified, a risk rating that ranges
172from *informational* to *critical* is given based on the likelihood of the
Tamas Bancf151b72022-11-30 17:06:05 +0100173threat occurring if a mitigation is not in place, and the impact of the
Zelalem05fed522021-02-24 19:20:09 -0600174threat (i.e. how severe the consequences could be). Table 4 explains each
175rating in terms of score, impact and likelihood.
176
177.. table:: Table 4: Rating and score as applied to impact and likelihood
178
179 +-----------------------+-------------------------+---------------------------+
180 | **Rating (Score)** | **Impact** | **Likelihood** |
181 +=======================+=========================+===========================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200182 | Critical (5) | | Extreme impact to | | Threat is almost |
Zelalem05fed522021-02-24 19:20:09 -0600183 | | entire organization | certain to be exploited.|
184 | | if exploited. | |
185 | | | | Knowledge of the threat |
186 | | | and how to exploit it |
187 | | | are in the public |
188 | | | domain. |
189 +-----------------------+-------------------------+---------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200190 | High (4) | | Major impact to entire| | Threat is relatively |
Zelalem05fed522021-02-24 19:20:09 -0600191 | | organization or single| easy to detect and |
192 | | line of business if | exploit by an attacker |
193 | | exploited | with little skill. |
194 +-----------------------+-------------------------+---------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200195 | Medium (3) | | Noticeable impact to | | A knowledgeable insider |
Zelalem05fed522021-02-24 19:20:09 -0600196 | | line of business if | or expert attacker could|
197 | | exploited. | exploit the threat |
198 | | | without much difficulty.|
199 +-----------------------+-------------------------+---------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200200 | Low (2) | | Minor damage if | | Exploiting the threat |
Zelalem05fed522021-02-24 19:20:09 -0600201 | | exploited or could | would require |
202 | | be used in conjunction| considerable expertise |
203 | | with other | and resources |
204 | | vulnerabilities to | |
205 | | perform a more serious| |
206 | | attack | |
207 +-----------------------+-------------------------+---------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200208 | Informational (1) | | Poor programming | | Threat is not likely |
Zelalem05fed522021-02-24 19:20:09 -0600209 | | practice or poor | to be exploited on its |
210 | | design decision that | own, but may be used to |
211 | | may not represent an | gain information for |
212 | | immediate risk on its | launching another |
213 | | own, but may have | attack |
214 | | security implications | |
215 | | if multiplied and/or | |
216 | | combined with other | |
217 | | threats. | |
218 +-----------------------+-------------------------+---------------------------+
219
220Aggregate risk scores are assigned to identified threats;
221specifically, the impact score multiplied by the likelihood score.
222For example, a threat with high likelihood and low impact would have an
223aggregate risk score of eight (8); that is, four (4) for high likelihood
224multiplied by two (2) for low impact. The aggregate risk score determines
225the finding's overall risk level, as shown in the following table.
226
227.. table:: Table 5: Overall risk levels and corresponding aggregate scores
228
229 +---------------------+-----------------------------------+
230 | Overall Risk Level | Aggregate Risk Score |
231 | | (Impact multiplied by Likelihood) |
232 +=====================+===================================+
233 | Critical | 20–25 |
234 +---------------------+-----------------------------------+
235 | High | 12–19 |
236 +---------------------+-----------------------------------+
237 | Medium | 6–11 |
238 +---------------------+-----------------------------------+
239 | Low | 2–5 |
240 +---------------------+-----------------------------------+
241 | Informational | 1 |
242 +---------------------+-----------------------------------+
243
244The likelihood and impact of a threat depends on the
245target environment in which TF-A is running. For example, attacks
246that require physical access are unlikely in server environments while
247they are more common in Internet of Things(IoT) environments.
248In this threat model we consider three target environments:
249``Internet of Things(IoT)``, ``Mobile`` and ``Server``.
250
251Threat Assessment
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200252=================
253
Zelalem05fed522021-02-24 19:20:09 -0600254The following threats were identified by applying STRIDE analysis on
255each diagram element of the data flow diagram.
256
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200257For each threat, we strive to indicate whether the mitigations are currently
258implemented or not. However, the answer to this question is not always straight
259forward. Some mitigations are partially implemented in the generic code but also
260rely on the platform code to implement some bits of it. This threat model aims
261to be platform-independent and it is important to keep in mind that such threats
262only get mitigated if the platform code properly fulfills its responsibilities.
263
264Also, some mitigations require enabling specific features, which must be
265explicitly turned on via a build flag.
266
267These are highlighted in the ``Mitigations implemented?`` box.
268
Zelalem05fed522021-02-24 19:20:09 -0600269+------------------------+----------------------------------------------------+
270| ID | 01 |
271+========================+====================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200272| Threat | | **An attacker can mangle firmware images to |
Zelalem05fed522021-02-24 19:20:09 -0600273| | execute arbitrary code** |
274| | |
275| | | Some TF-A images are loaded from external |
276| | storage. It is possible for an attacker to access|
277| | the external flash memory and change its contents|
278| | physically, through the Rich OS, or using the |
279| | updating mechanism to modify the non-volatile |
280| | images to execute arbitrary code. |
281+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200282| Diagram Elements | DF1, DF4, DF5 |
Zelalem05fed522021-02-24 19:20:09 -0600283+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200284| Affected TF-A | BL2, BL31 |
285| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600286+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200287| Assets | Code Execution |
Zelalem05fed522021-02-24 19:20:09 -0600288+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200289| Threat Agent | PhysicalAccess, NSCode, SecCode |
Zelalem05fed522021-02-24 19:20:09 -0600290+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200291| Threat Type | Tampering, Elevation of Privilege |
Zelalem05fed522021-02-24 19:20:09 -0600292+------------------------+------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200293| Application | Server | IoT | Mobile |
Zelalem05fed522021-02-24 19:20:09 -0600294+------------------------+------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200295| Impact | Critical (5) | Critical (5) | Critical (5) |
Zelalem05fed522021-02-24 19:20:09 -0600296+------------------------+------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200297| Likelihood | Critical (5) | Critical (5) | Critical (5) |
Zelalem05fed522021-02-24 19:20:09 -0600298+------------------------+------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200299| Total Risk Rating | Critical (25) | Critical (25) | Critical (25) |
Zelalem05fed522021-02-24 19:20:09 -0600300+------------------------+------------------+-----------------+---------------+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200301| Mitigations | | 1) Implement the `Trusted Board Boot (TBB)`_ |
Zelalem05fed522021-02-24 19:20:09 -0600302| | feature which prevents malicious firmware from |
303| | running on the platform by authenticating all |
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200304| | firmware images. |
305| | |
306| | | 2) Perform extra checks on unauthenticated data, |
307| | such as FIP metadata, prior to use. |
308+------------------------+----------------------------------------------------+
309| Mitigations | | 1) Yes, provided that the ``TRUSTED_BOARD_BOOT`` |
310| implemented? | build option is set to 1. |
311| | |
312| | | 2) Yes. |
Zelalem05fed522021-02-24 19:20:09 -0600313+------------------------+----------------------------------------------------+
314
315+------------------------+----------------------------------------------------+
316| ID | 02 |
317+========================+====================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200318| Threat | | **An attacker may attempt to boot outdated, |
Zelalem05fed522021-02-24 19:20:09 -0600319| | potentially vulnerable firmware image** |
320| | |
321| | | When updating firmware, an attacker may attempt |
322| | to rollback to an older version that has unfixed |
323| | vulnerabilities. |
324+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200325| Diagram Elements | DF1, DF4, DF5 |
Zelalem05fed522021-02-24 19:20:09 -0600326+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200327| Affected TF-A | BL2, BL31 |
328| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600329+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200330| Assets | Code Execution |
Zelalem05fed522021-02-24 19:20:09 -0600331+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200332| Threat Agent | PhysicalAccess, NSCode, SecCode |
Zelalem05fed522021-02-24 19:20:09 -0600333+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200334| Threat Type | Tampering |
Zelalem05fed522021-02-24 19:20:09 -0600335+------------------------+------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200336| Application | Server | IoT | Mobile |
Zelalem05fed522021-02-24 19:20:09 -0600337+------------------------+------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200338| Impact | Critical (5) | Critical (5) | Critical (5) |
Zelalem05fed522021-02-24 19:20:09 -0600339+------------------------+------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200340| Likelihood | Critical (5) | Critical (5) | Critical (5) |
Zelalem05fed522021-02-24 19:20:09 -0600341+------------------------+------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200342| Total Risk Rating | Critical (25) | Critical (25) | Critical (25) |
Zelalem05fed522021-02-24 19:20:09 -0600343+------------------------+------------------+-----------------+---------------+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200344| Mitigations | Implement anti-rollback protection using |
345| | non-volatile counters (NV counters) as required |
346| | by `TBBR-Client specification`_. |
347+------------------------+----------------------------------------------------+
348| Mitigations | | Yes / Platform specific. |
349| implemented? | |
350| | | After a firmware image is validated, the image |
351| | revision number taken from a certificate |
352| | extension field is compared with the |
353| | corresponding NV counter stored in hardware to |
354| | make sure the new counter value is larger than |
355| | the current counter value. |
356| | |
357| | | **Platforms must implement this protection using |
358| | platform specific hardware NV counters.** |
Zelalem05fed522021-02-24 19:20:09 -0600359+------------------------+----------------------------------------------------+
360
361+------------------------+-------------------------------------------------------+
362| ID | 03 |
363+========================+=======================================================+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200364| Threat | | **An attacker can use Time-of-Check-Time-of-Use |
Zelalem05fed522021-02-24 19:20:09 -0600365| | (TOCTOU) attack to bypass image authentication |
366| | during the boot process** |
367| | |
368| | | Time-of-Check-Time-of-Use (TOCTOU) threats occur |
369| | when the security check is produced before the time |
370| | the resource is accessed. If an attacker is sitting |
371| | in the middle of the off-chip images, they could |
372| | change the binary containing executable code right |
373| | after the integrity and authentication check has |
374| | been performed. |
375+------------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200376| Diagram Elements | DF1 |
Zelalem05fed522021-02-24 19:20:09 -0600377+------------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200378| Affected TF-A | BL1, BL2 |
379| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600380+------------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200381| Assets | Code Execution, Sensitive Data |
Zelalem05fed522021-02-24 19:20:09 -0600382+------------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200383| Threat Agent | PhysicalAccess |
Zelalem05fed522021-02-24 19:20:09 -0600384+------------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200385| Threat Type | Elevation of Privilege |
Zelalem05fed522021-02-24 19:20:09 -0600386+------------------------+---------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200387| Application | Server | IoT | Mobile |
Zelalem05fed522021-02-24 19:20:09 -0600388+------------------------+---------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200389| Impact | N/A | Critical (5) | Critical (5) |
Zelalem05fed522021-02-24 19:20:09 -0600390+------------------------+---------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200391| Likelihood | N/A | Medium (3) | Medium (3) |
Zelalem05fed522021-02-24 19:20:09 -0600392+------------------------+---------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200393| Total Risk Rating | N/A | High (15) | High (15) |
Zelalem05fed522021-02-24 19:20:09 -0600394+------------------------+---------------------+-----------------+---------------+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200395| Mitigations | Copy image to on-chip memory before authenticating |
396| | it. |
397+------------------------+-------------------------------------------------------+
398| Mitigations | | Platform specific. |
399| implemented? | |
400| | | The list of images to load and their location is |
401| | platform specific. Platforms are responsible for |
402| | arranging images to be loaded in on-chip memory. |
Zelalem05fed522021-02-24 19:20:09 -0600403+------------------------+-------------------------------------------------------+
404
405+------------------------+-------------------------------------------------------+
406| ID | 04 |
407+========================+=======================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200408| Threat | | **An attacker with physical access can execute |
Zelalem05fed522021-02-24 19:20:09 -0600409| | arbitrary image by bypassing the signature |
410| | verification stage using glitching techniques** |
411| | |
412| | | Glitching (Fault injection) attacks attempt to put |
413| | a hardware into a undefined state by manipulating an|
414| | environmental variable such as power supply. |
415| | |
416| | | TF-A relies on a chain of trust that starts with the|
417| | ROTPK, which is the key stored inside the chip and |
418| | the root of all validation processes. If an attacker|
419| | can break this chain of trust, they could execute |
420| | arbitrary code on the device. This could be |
421| | achieved with physical access to the device by |
422| | attacking the normal execution flow of the |
423| | process using glitching techniques that target |
424| | points where the image is validated against the |
425| | signature. |
426+------------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200427| Diagram Elements | DF1 |
Zelalem05fed522021-02-24 19:20:09 -0600428+------------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200429| Affected TF-A | BL1, BL2 |
430| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600431+------------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200432| Assets | Code Execution |
Zelalem05fed522021-02-24 19:20:09 -0600433+------------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200434| Threat Agent | PhysicalAccess |
Zelalem05fed522021-02-24 19:20:09 -0600435+------------------------+-------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200436| Threat Type | Tampering, Elevation of Privilege |
Zelalem05fed522021-02-24 19:20:09 -0600437+------------------------+---------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200438| Application | Server | IoT | Mobile |
Zelalem05fed522021-02-24 19:20:09 -0600439+------------------------+---------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200440| Impact | N/A | Critical (5) | Critical (5) |
Zelalem05fed522021-02-24 19:20:09 -0600441+------------------------+---------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200442| Likelihood | N/A | Medium (3) | Medium (3) |
Zelalem05fed522021-02-24 19:20:09 -0600443+------------------------+---------------------+-----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200444| Total Risk Rating | N/A | High (15) | High (15) |
Zelalem05fed522021-02-24 19:20:09 -0600445+------------------------+---------------------+-----------------+---------------+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200446| Mitigations | Mechanisms to detect clock glitch and power |
447| | variations. |
448+------------------------+-------------------------------------------------------+
449| Mitigations | | No. |
450| implemented? | |
451| | | The most effective mitigation is adding glitching |
Zelalem05fed522021-02-24 19:20:09 -0600452| | detection and mitigation circuit at the hardware |
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200453| | level. |
454| | |
455| | | However, software techniques, such as adding |
456| | redundant checks when performing conditional |
457| | branches that are security sensitive, can be used |
458| | to harden TF-A against such attacks. |
Zelalem05fed522021-02-24 19:20:09 -0600459| | **At the moment TF-A doesn't implement such |
460| | mitigations.** |
461+------------------------+-------------------------------------------------------+
462
463+------------------------+---------------------------------------------------+
464| ID | 05 |
465+========================+===================================================+
Sandrine Bailleuxb8d854d2022-05-16 13:57:38 +0200466| Threat | | **Information leak via UART logs** |
Zelalem05fed522021-02-24 19:20:09 -0600467| | |
468| | | During the development stages of software it is |
Sandrine Bailleuxb8d854d2022-05-16 13:57:38 +0200469| | common to print all sorts of information on the |
470| | console, including sensitive or confidential |
471| | information such as crash reports with detailed |
472| | information of the CPU state, current registers |
473| | values, privilege level or stack dumps. |
474| | |
475| | | This information is useful when debugging |
476| | problems before releasing the production |
477| | version but it could be used by an attacker |
478| | to develop a working exploit if left enabled in |
479| | the production version. |
480| | |
481| | | This happens when directly logging sensitive |
482| | information and more subtly when logging |
483| | side-channel information that can be used by an |
484| | attacker to learn about sensitive information. |
Zelalem05fed522021-02-24 19:20:09 -0600485+------------------------+---------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200486| Diagram Elements | DF2 |
Zelalem05fed522021-02-24 19:20:09 -0600487+------------------------+---------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200488| Affected TF-A | BL1, BL2, BL31 |
489| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600490+------------------------+---------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200491| Assets | Sensitive Data |
Zelalem05fed522021-02-24 19:20:09 -0600492+------------------------+---------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200493| Threat Agent | AppDebug |
Zelalem05fed522021-02-24 19:20:09 -0600494+------------------------+---------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200495| Threat Type | Information Disclosure |
Zelalem05fed522021-02-24 19:20:09 -0600496+------------------------+------------------+----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200497| Application | Server | IoT | Mobile |
Zelalem05fed522021-02-24 19:20:09 -0600498+------------------------+------------------+----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200499| Impact | N/A | Low (2) | Low (2) |
Zelalem05fed522021-02-24 19:20:09 -0600500+------------------------+------------------+----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200501| Likelihood | N/A | High (4) | High (4) |
Zelalem05fed522021-02-24 19:20:09 -0600502+------------------------+------------------+----------------+---------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200503| Total Risk Rating | N/A | Medium (8) | Medium (8) |
Zelalem05fed522021-02-24 19:20:09 -0600504+------------------------+------------------+----------------+---------------+
Sandrine Bailleuxb8d854d2022-05-16 13:57:38 +0200505| Mitigations | | Remove sensitive information logging in |
506| | production releases. |
507| | |
508| | | Do not conditionally log information depending |
509| | on potentially sensitive data. |
510| | |
511| | | Do not log high precision timing information. |
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200512+------------------------+---------------------------------------------------+
513| Mitigations | | Yes / Platform Specific. |
514| implemented? | Requires the right build options to be used. |
515| | |
516| | | Crash reporting is only enabled for debug |
517| | builds by default, see ``CRASH_REPORTING`` |
518| | build option. |
519| | |
520| | | The log level can be tuned at build time, from |
521| | very verbose to no output at all. See |
522| | ``LOG_LEVEL`` build option. By default, release |
523| | builds are a lot less verbose than debug ones |
524| | but still produce some output. |
525| | |
526| | | Messages produced by the platform code should |
527| | use the appropriate level of verbosity so as |
528| | not to leak sensitive information in production |
529| | builds. |
Zelalem05fed522021-02-24 19:20:09 -0600530+------------------------+---------------------------------------------------+
531
532+------------------------+----------------------------------------------------+
533| ID | 06 |
534+========================+====================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200535| Threat | | **An attacker can read sensitive data and |
Zelalem05fed522021-02-24 19:20:09 -0600536| | execute arbitrary code through the external |
537| | debug and trace interface** |
538| | |
539| | | Arm processors include hardware-assisted debug |
540| | and trace features that can be controlled without|
541| | the need for software operating on the platform. |
542| | If left enabled without authentication, this |
543| | feature can be used by an attacker to inspect and|
544| | modify TF-A registers and memory allowing the |
545| | attacker to read sensitive data and execute |
546| | arbitrary code. |
547+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200548| Diagram Elements | DF3 |
Zelalem05fed522021-02-24 19:20:09 -0600549+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200550| Affected TF-A | BL1, BL2, BL31 |
551| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600552+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200553| Assets | Code Execution, Sensitive Data |
Zelalem05fed522021-02-24 19:20:09 -0600554+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200555| Threat Agent | AppDebug |
Zelalem05fed522021-02-24 19:20:09 -0600556+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200557| Threat Type | Tampering, Information Disclosure, |
Zelalem05fed522021-02-24 19:20:09 -0600558| | Elevation of privilege |
559+------------------------+------------------+---------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200560| Application | Server | IoT | Mobile |
Zelalem05fed522021-02-24 19:20:09 -0600561+------------------------+------------------+---------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200562| Impact | N/A | High (4) | High (4) |
Zelalem05fed522021-02-24 19:20:09 -0600563+------------------------+------------------+---------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200564| Likelihood | N/A | Critical (5) | Critical (5) |
Zelalem05fed522021-02-24 19:20:09 -0600565+------------------------+------------------+---------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200566| Total Risk Rating | N/A | Critical (20) | Critical (20) |
Zelalem05fed522021-02-24 19:20:09 -0600567+------------------------+------------------+---------------+-----------------+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200568| Mitigations | Disable the debug and trace capability for |
569| | production releases or enable proper debug |
570| | authentication as recommended by [`DEN0034`_]. |
571+------------------------+----------------------------------------------------+
572| Mitigations | | Platform specific. |
573| implemented? | |
574| | | Configuration of debug and trace capabilities is |
575| | entirely platform specific. |
Zelalem05fed522021-02-24 19:20:09 -0600576+------------------------+----------------------------------------------------+
577
578+------------------------+------------------------------------------------------+
579| ID | 07 |
580+========================+======================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200581| Threat | | **An attacker can perform a denial-of-service |
Zelalem05fed522021-02-24 19:20:09 -0600582| | attack by using a broken SMC call that causes the |
583| | system to reboot or enter into unknown state.** |
584| | |
585| | | Secure and non-secure clients access TF-A services |
586| | through SMC calls. Malicious code can attempt to |
587| | place the TF-A runtime into an inconsistent state |
588| | by calling unimplemented SMC call or by passing |
589| | invalid arguments. |
590+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200591| Diagram Elements | DF4, DF5 |
Zelalem05fed522021-02-24 19:20:09 -0600592+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200593| Affected TF-A | BL31 |
594| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600595+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200596| Assets | Availability |
Zelalem05fed522021-02-24 19:20:09 -0600597+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200598| Threat Agent | NSCode, SecCode |
Zelalem05fed522021-02-24 19:20:09 -0600599+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200600| Threat Type | Denial of Service |
Zelalem05fed522021-02-24 19:20:09 -0600601+------------------------+-------------------+----------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200602| Application | Server | IoT | Mobile |
Zelalem05fed522021-02-24 19:20:09 -0600603+------------------------+-------------------+----------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200604| Impact | Medium (3) | Medium (3) | Medium (3) |
Zelalem05fed522021-02-24 19:20:09 -0600605+------------------------+-------------------+----------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200606| Likelihood | High (4) | High (4) | High (4) |
Zelalem05fed522021-02-24 19:20:09 -0600607+------------------------+-------------------+----------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200608| Total Risk Rating | High (12) | High (12) | High (12) |
Zelalem05fed522021-02-24 19:20:09 -0600609+------------------------+-------------------+----------------+-----------------+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200610| Mitigations | Validate SMC function ids and arguments before using |
611| | them. |
612+------------------------+------------------------------------------------------+
613| Mitigations | | Yes / Platform specific. |
614| implemented? | |
615| | | For standard services, all input is validated. |
616| | |
617| | | Platforms that implement SiP services must also |
Zelalem05fed522021-02-24 19:20:09 -0600618| | validate SMC call arguments. |
619+------------------------+------------------------------------------------------+
620
621+------------------------+------------------------------------------------------+
622| ID | 08 |
623+========================+======================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200624| Threat | | **Memory corruption due to memory overflows and |
Zelalem05fed522021-02-24 19:20:09 -0600625| | lack of boundary checking when accessing resources |
626| | could allow an attacker to execute arbitrary code, |
627| | modify some state variable to change the normal |
628| | flow of the program, or leak sensitive |
629| | information** |
630| | |
Sandrine Bailleux0b816db2022-05-13 12:40:22 +0200631| | | Like in other software, TF-A has multiple points |
632| | where memory corruption security errors can arise. |
Zelalem05fed522021-02-24 19:20:09 -0600633| | |
634| | | Some of the errors include integer overflow, |
635| | buffer overflow, incorrect array boundary checks, |
636| | and incorrect error management. |
637| | Improper use of asserts instead of proper input |
638| | validations might also result in these kinds of |
639| | errors in release builds. |
640+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200641| Diagram Elements | DF4, DF5 |
Zelalem05fed522021-02-24 19:20:09 -0600642+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200643| Affected TF-A | BL1, BL2, BL31 |
644| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600645+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200646| Assets | Code Execution, Sensitive Data |
Zelalem05fed522021-02-24 19:20:09 -0600647+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200648| Threat Agent | NSCode, SecCode |
Zelalem05fed522021-02-24 19:20:09 -0600649+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200650| Threat Type | Tampering, Information Disclosure, |
Zelalem05fed522021-02-24 19:20:09 -0600651| | Elevation of Privilege |
652+------------------------+-------------------+-----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200653| Application | Server | IoT | Mobile |
Zelalem05fed522021-02-24 19:20:09 -0600654+------------------------+-------------------+-----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200655| Impact | Critical (5) | Critical (5) | Critical (5) |
Zelalem05fed522021-02-24 19:20:09 -0600656+------------------------+-------------------+-----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200657| Likelihood | Medium (3 | Medium (3) | Medium (3) |
Zelalem05fed522021-02-24 19:20:09 -0600658+------------------------+-------------------+-----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200659| Total Risk Rating | High (15) | High (15) | High (15) |
Zelalem05fed522021-02-24 19:20:09 -0600660+------------------------+-------------------+-----------------+----------------+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200661| Mitigations | | 1) Use proper input validation. |
Zelalem05fed522021-02-24 19:20:09 -0600662| | |
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200663| | | 2) Code reviews, testing. |
664+------------------------+------------------------------------------------------+
665| Mitigations | | 1) Yes. |
666| implemented? | Data received from normal world, such as addresses |
Zelalem05fed522021-02-24 19:20:09 -0600667| | and sizes identifying memory regions, are |
668| | sanitized before being used. These security checks |
669| | make sure that the normal world software does not |
670| | access memory beyond its limit. |
671| | |
672| | | By default *asserts* are only used to check for |
673| | programming errors in debug builds. Other types of |
674| | errors are handled through condition checks that |
675| | remain enabled in release builds. See |
676| | `TF-A error handling policy`_. TF-A provides an |
677| | option to use *asserts* in release builds, however |
678| | we recommend using proper runtime checks instead |
679| | of relying on asserts in release builds. |
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200680| | |
681| | | 2) Yes. |
682| | TF-A uses a combination of manual code reviews |
683| | and automated program analysis and testing to |
684| | detect and fix memory corruption bugs. All TF-A |
685| | code including platform code go through manual |
686| | code reviews. Additionally, static code analysis |
687| | is performed using Coverity Scan on all TF-A code. |
688| | The code is also tested with |
689| | `Trusted Firmware-A Tests`_ on Juno and FVP |
690| | platforms. |
Zelalem05fed522021-02-24 19:20:09 -0600691+------------------------+------------------------------------------------------+
692
693+------------------------+------------------------------------------------------+
694| ID | 09 |
695+========================+======================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200696| Threat | | **Improperly handled SMC calls can leak register |
Zelalem05fed522021-02-24 19:20:09 -0600697| | contents** |
698| | |
Sandrine Bailleux1c7d74e2022-05-12 16:37:18 +0200699| | | When switching between worlds, TF-A register state |
700| | can leak to software in different security |
701| | contexts. |
Zelalem05fed522021-02-24 19:20:09 -0600702+------------------------+------------------------------------------------------+
Sandrine Bailleux1c7d74e2022-05-12 16:37:18 +0200703| Diagram Elements | DF4, DF5 |
Zelalem05fed522021-02-24 19:20:09 -0600704+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200705| Affected TF-A | BL31 |
706| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600707+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200708| Assets | Sensitive Data |
Zelalem05fed522021-02-24 19:20:09 -0600709+------------------------+------------------------------------------------------+
Sandrine Bailleux1c7d74e2022-05-12 16:37:18 +0200710| Threat Agent | NSCode, SecCode |
Zelalem05fed522021-02-24 19:20:09 -0600711+------------------------+------------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200712| Threat Type | Information Disclosure |
Zelalem05fed522021-02-24 19:20:09 -0600713+------------------------+-------------------+----------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200714| Application | Server | IoT | Mobile |
Zelalem05fed522021-02-24 19:20:09 -0600715+------------------------+-------------------+----------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200716| Impact | Medium (3) | Medium (3) | Medium (3) |
Zelalem05fed522021-02-24 19:20:09 -0600717+------------------------+-------------------+----------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200718| Likelihood | High (4) | High (4) | High (4) |
Zelalem05fed522021-02-24 19:20:09 -0600719+------------------------+-------------------+----------------+-----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200720| Total Risk Rating | High (12) | High (12) | High (12) |
Zelalem05fed522021-02-24 19:20:09 -0600721+------------------------+-------------------+----------------+-----------------+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200722| Mitigations | Save and restore registers when switching contexts. |
723+------------------------+------------------------------------------------------+
724| Mitigations | | Yes. |
725| implemented? | |
726| | | This is the default behaviour in TF-A. |
727| | Build options are also provided to save/restore |
728| | additional registers such as floating-point |
729| | registers. These should be enabled if required. |
Zelalem05fed522021-02-24 19:20:09 -0600730+------------------------+------------------------------------------------------+
731
732+------------------------+-----------------------------------------------------+
733| ID | 10 |
734+========================+=====================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200735| Threat | | **SMC calls can leak sensitive information from |
Zelalem05fed522021-02-24 19:20:09 -0600736| | TF-A memory via microarchitectural side channels**|
737| | |
738| | | Microarchitectural side-channel attacks such as |
739| | `Spectre`_ can be used to leak data across |
740| | security boundaries. An attacker might attempt to |
741| | use this kind of attack to leak sensitive |
742| | data from TF-A memory. |
743+------------------------+-----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200744| Diagram Elements | DF4, DF5 |
Zelalem05fed522021-02-24 19:20:09 -0600745+------------------------+-----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200746| Affected TF-A | BL31 |
747| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600748+------------------------+-----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200749| Assets | Sensitive Data |
Zelalem05fed522021-02-24 19:20:09 -0600750+------------------------+-----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200751| Threat Agent | SecCode, NSCode |
Zelalem05fed522021-02-24 19:20:09 -0600752+------------------------+-----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200753| Threat Type | Information Disclosure |
Zelalem05fed522021-02-24 19:20:09 -0600754+------------------------+-------------------+----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200755| Application | Server | IoT | Mobile |
Zelalem05fed522021-02-24 19:20:09 -0600756+------------------------+-------------------+----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200757| Impact | Medium (3) | Medium (3) | Medium (3) |
Zelalem05fed522021-02-24 19:20:09 -0600758+------------------------+-------------------+----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200759| Likelihood | Medium (3) | Medium (3) | Medium (3) |
Zelalem05fed522021-02-24 19:20:09 -0600760+------------------------+-------------------+----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200761| Total Risk Rating | Medium (9) | Medium (9) | Medium (9) |
Zelalem05fed522021-02-24 19:20:09 -0600762+------------------------+-------------------+----------------+----------------+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200763| Mitigations | Enable appropriate side-channel protections. |
764+------------------------+-----------------------------------------------------+
765| Mitigations | | Yes / Platform specific. |
766| implemented? | |
767| | | TF-A implements software mitigations for Spectre |
Zelalem05fed522021-02-24 19:20:09 -0600768| | type attacks as recommended by `Cache Speculation |
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200769| | Side-channels`_ for the generic code. |
770| | |
771| | | SiPs should implement similar mitigations for |
772| | code that is deemed to be vulnerable to such |
773| | attacks. |
Zelalem05fed522021-02-24 19:20:09 -0600774+------------------------+-----------------------------------------------------+
775
776+------------------------+----------------------------------------------------+
777| ID | 11 |
778+========================+====================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200779| Threat | | **Misconfiguration of the Memory Management Unit |
Zelalem05fed522021-02-24 19:20:09 -0600780| | (MMU) may allow a normal world software to |
Tamas Bancf151b72022-11-30 17:06:05 +0100781| | access sensitive data, execute arbitrary |
782| | code or access otherwise restricted HW |
783| | interface** |
Zelalem05fed522021-02-24 19:20:09 -0600784| | |
785| | | A misconfiguration of the MMU could |
786| | lead to an open door for software running in the |
787| | normal world to access sensitive data or even |
788| | execute code if the proper security mechanisms |
789| | are not in place. |
790+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200791| Diagram Elements | DF5, DF6 |
Zelalem05fed522021-02-24 19:20:09 -0600792+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200793| Affected TF-A | BL1, BL2, BL31 |
794| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600795+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200796| Assets | Sensitive Data, Code execution |
Zelalem05fed522021-02-24 19:20:09 -0600797+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200798| Threat Agent | NSCode |
Zelalem05fed522021-02-24 19:20:09 -0600799+------------------------+----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200800| Threat Type | Information Disclosure, Elevation of Privilege |
Zelalem05fed522021-02-24 19:20:09 -0600801+------------------------+-----------------+-----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200802| Application | Server | IoT | Mobile |
Zelalem05fed522021-02-24 19:20:09 -0600803+------------------------+-----------------+-----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200804| Impact | Critical (5) | Critical (5) | Critical (5) |
Zelalem05fed522021-02-24 19:20:09 -0600805+------------------------+-----------------+-----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200806| Likelihood | High (4) | High (4) | High (4) |
Zelalem05fed522021-02-24 19:20:09 -0600807+------------------------+-----------------+-----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200808| Total Risk Rating | Critical (20) | Critical (20) | Critical (20) |
Zelalem05fed522021-02-24 19:20:09 -0600809+------------------------+-----------------+-----------------+----------------+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200810| Mitigations | When configuring access permissions, the |
811| | principle of least privilege ought to be |
812| | enforced. This means we should not grant more |
813| | privileges than strictly needed, e.g. code |
814| | should be read-only executable, read-only data |
815| | should be read-only execute-never, and so on. |
816+------------------------+----------------------------------------------------+
817| Mitigations | | Platform specific. |
818| implemented? | |
819| | | MMU configuration is platform specific, |
820| | therefore platforms need to make sure that the |
821| | correct attributes are assigned to memory |
822| | regions. |
823| | |
824| | | TF-A provides a library which abstracts the |
825| | low-level details of MMU configuration. It |
826| | provides well-defined and tested APIs. |
827| | Platforms are encouraged to use it to limit the |
828| | risk of misconfiguration. |
Zelalem05fed522021-02-24 19:20:09 -0600829+------------------------+----------------------------------------------------+
830
831+------------------------+-----------------------------------------------------+
832| ID | 12 |
833+========================+=====================================================+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200834| Threat | | **Incorrect configuration of Performance Monitor |
Zelalem05fed522021-02-24 19:20:09 -0600835| | Unit (PMU) counters can allow an attacker to |
836| | mount side-channel attacks using information |
837| | exposed by the counters** |
838| | |
839| | | Non-secure software can configure PMU registers |
840| | to count events at any exception level and in |
841| | both Secure and Non-secure states. This allows |
842| | a Non-secure software (or a lower-level Secure |
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200843| | software) to potentially carry out |
Zelalem05fed522021-02-24 19:20:09 -0600844| | side-channel timing attacks against TF-A. |
845+------------------------+-----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200846| Diagram Elements | DF5, DF6 |
Zelalem05fed522021-02-24 19:20:09 -0600847+------------------------+-----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200848| Affected TF-A | BL31 |
849| Components | |
Zelalem05fed522021-02-24 19:20:09 -0600850+------------------------+-----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200851| Assets | Sensitive Data |
Zelalem05fed522021-02-24 19:20:09 -0600852+------------------------+-----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200853| Threat Agent | NSCode |
Zelalem05fed522021-02-24 19:20:09 -0600854+------------------------+-----------------------------------------------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200855| Threat Type | Information Disclosure |
Zelalem05fed522021-02-24 19:20:09 -0600856+------------------------+-------------------+----------------+----------------+
Tamas Bancf151b72022-11-30 17:06:05 +0100857| Application | Server | IoT | Mobile |
858+------------------------+-------------------+----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200859| Impact | Medium (3) | Medium (3) | Medium (3) |
Zelalem05fed522021-02-24 19:20:09 -0600860+------------------------+-------------------+----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200861| Likelihood | Low (2) | Low (2) | Low (2) |
Zelalem05fed522021-02-24 19:20:09 -0600862+------------------------+-------------------+----------------+----------------+
Sandrine Bailleux6e5c2182022-05-10 14:55:01 +0200863| Total Risk Rating | Medium (6) | Medium (6) | Medium (6) |
Zelalem05fed522021-02-24 19:20:09 -0600864+------------------------+-------------------+----------------+----------------+
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200865| Mitigations | Follow mitigation strategies as described in |
866| | `Secure Development Guidelines`_. |
867+------------------------+-----------------------------------------------------+
868| Mitigations | | Yes / platform specific. |
869| implemented? | |
870| | | General events and cycle counting in the Secure |
871| | world is prohibited by default when applicable. |
872| | |
873| | | However, on some implementations (e.g. PMUv3) |
874| | Secure world event counting depends on external |
875| | debug interface signals, i.e. Secure world event |
876| | counting is enabled if external debug is enabled. |
877| | |
878| | | Configuration of debug signals is platform |
Zelalem05fed522021-02-24 19:20:09 -0600879| | specific, therefore platforms need to make sure |
880| | that external debug is disabled in production or |
Sandrine Bailleux94e70092022-05-13 12:39:56 +0200881| | proper debug authentication is in place. This |
882| | should be the case if threat #06 is properly |
883| | mitigated. |
Zelalem05fed522021-02-24 19:20:09 -0600884+------------------------+-----------------------------------------------------+
885
Tamas Bancf151b72022-11-30 17:06:05 +0100886+------------------------+-----------------------------------------------------+
887| ID | 13 |
888+========================+=====================================================+
889| Threat | | **Leaving sensitive information in the memory, |
890| | can allow an attacker to retrieve them.** |
891| | |
892| | | Accidentally leaving not-needed sensitive data in |
893| | internal buffers can leak them if an attacker |
894| | gains access to memory due to a vulnerability. |
895+------------------------+-----------------------------------------------------+
896| Diagram Elements | DF4, DF5 |
897+------------------------+-----------------------------------------------------+
898| Affected TF-A | BL1, BL2, BL31 |
899| Components | |
900+------------------------+-----------------------------------------------------+
901| Assets | Sensitive Data |
902+------------------------+-----------------------------------------------------+
903| Threat Agent | NSCode, SecCode |
904+------------------------+-----------------------------------------------------+
905| Threat Type | Information Disclosure |
906+------------------------+-------------------+----------------+----------------+
907| Application | Server | IoT | Mobile |
908+------------------------+-------------------+----------------+----------------+
909| Impact | Critical (5) | Critical (5) | Critical (5) |
910+------------------------+-------------------+----------------+----------------+
911| Likelihood | Medium (3) | Medium (3) | Medium (3) |
912+------------------------+-------------------+----------------+----------------+
913| Total Risk Rating | High (15) | High (15) | High (15) |
914+------------------------+-------------------+----------------+----------------+
915| Mitigations | Clear the sensitive data from internal buffers as |
916| | soon as they are not needed anymore. |
917+------------------------+-----------------------------------------------------+
918| Mitigations | | Yes / Platform specific |
919+------------------------+-----------------------------------------------------+
920
Jeffrey Kardatzke7e6b09a2022-10-03 15:50:21 -0700921+------------------------+-----------------------------------------------------+
922| ID | 14 |
923+========================+=====================================================+
Jeffrey Kardatzkeab7e5572023-02-09 11:03:17 -0800924| Threat | | **Attacker wants to execute an arbitrary or |
925| | untrusted binary as the secure OS.** |
Jeffrey Kardatzke7e6b09a2022-10-03 15:50:21 -0700926| | |
Jeffrey Kardatzkeab7e5572023-02-09 11:03:17 -0800927| | | When the option OPTEE_ALLOW_SMC_LOAD is enabled, |
928| | this trusts the non-secure world up until the |
929| | point it issues the SMC call to load the Secure |
930| | BL32 payload. If a compromise occurs before the |
931| | SMC call is invoked, then arbitrary code execution|
932| | in S-EL1 can occur or arbitrary memory in EL3 can |
933| | be overwritten. |
Jeffrey Kardatzke7e6b09a2022-10-03 15:50:21 -0700934+------------------------+-----------------------------------------------------+
935| Diagram Elements | DF5 |
936+------------------------+-----------------------------------------------------+
937| Affected TF-A | BL31, BL32 |
938| Components | |
939+------------------------+-----------------------------------------------------+
940| Assets | Code Execution, Sensitive Data |
941+------------------------+-----------------------------------------------------+
942| Threat Agent | NSCode |
943+------------------------+-----------------------------------------------------+
944| Threat Type | Tampering, Information Disclosure, |
945| | Elevation of privilege |
946+------------------------+-----------------+-----------------+-----------------+
947| Application | Server | IoT | Mobile |
948+------------------------+-----------------+-----------------+-----------------+
949| Impact | Critical (5) | Critical (5) | Critical (5) |
950+------------------------+-----------------+-----------------+-----------------+
Jeffrey Kardatzkeab7e5572023-02-09 11:03:17 -0800951| Likelihood | High (4) | High (4) | High (4) |
Jeffrey Kardatzke7e6b09a2022-10-03 15:50:21 -0700952+------------------------+-----------------+-----------------+-----------------+
Jeffrey Kardatzkeab7e5572023-02-09 11:03:17 -0800953| Total Risk Rating | Critical (20) | Critical (20) | Critical (20) |
Jeffrey Kardatzke7e6b09a2022-10-03 15:50:21 -0700954+------------------------+-----------------+-----------------+-----------------+
955| Mitigations | When enabling the option OPTEE_ALLOW_SMC_LOAD, |
956| | the non-secure OS must be considered a closed |
957| | platform up until the point the SMC can be invoked |
958| | to load OP-TEE. |
959+------------------------+-----------------------------------------------------+
960| Mitigations | | None in TF-A itself. This option is only used by |
961| implemented? | ChromeOS currently which has other mechanisms to |
962| | to mitigate this threat which are described in |
963| | `OP-TEE Dispatcher`_. |
964+------------------------+-----------------------------------------------------+
965
Zelalem05fed522021-02-24 19:20:09 -0600966--------------
967
Jeffrey Kardatzke7e6b09a2022-10-03 15:50:21 -0700968*Copyright (c) 2021-2023, Arm Limited. All rights reserved.*
Zelalem05fed522021-02-24 19:20:09 -0600969
970
971.. _STRIDE threat analysis technique: https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats#stride-model
972.. _DEN0034: https://developer.arm.com/documentation/den0034/latest
973.. _Cache Speculation Side-channels: https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
974.. _Spectre: https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
975.. _TBBR-Client specification: https://developer.arm.com/documentation/den0006/d/
976.. _Trusted Board Boot (TBB): https://trustedfirmware-a.readthedocs.io/en/latest/design/trusted-board-boot.html
977.. _TF-A error handling policy: https://trustedfirmware-a.readthedocs.io/en/latest/process/coding-guidelines.html#error-handling-and-robustness
978.. _Secure Development Guidelines: https://trustedfirmware-a.readthedocs.io/en/latest/process/security-hardening.html#secure-development-guidelines
Olivier Deprez86d1ffd2021-06-01 15:37:16 +0200979.. _Trusted Firmware-A Tests: https://git.trustedfirmware.org/TF-A/tf-a-tests.git/about/
Jeffrey Kardatzke7e6b09a2022-10-03 15:50:21 -0700980.. _OP-TEE Dispatcher: https://github.com/ARM-software/arm-trusted-firmware/blob/master/docs/components/spd/optee-dispatcher.rst