Don't CWEAT It: Toward CWE Analysis Techniques in Early Stages of Hardware Design

TL;DR

This paper presents early-stage hardware security scanners for RTL designs that identify potential weaknesses related to common vulnerabilities, aiming to prevent costly security issues later in the design process.

Contribution

It introduces practical static analysis tools for Verilog source code to detect CWE-related security weaknesses during early hardware design stages.

Findings

Identified 53 potential weaknesses in open source hardware designs.

Confirmed 11 of these weaknesses as actual security concerns.

Prototyped and evaluated scanners on multiple open source hardware projects.

Abstract

To help prevent hardware security vulnerabilities from propagating to later design stages where fixes are costly, it is crucial to identify security concerns as early as possible, such as in RTL designs. In this work, we investigate the practical implications and feasibility of producing a set of security-specific scanners that operate on Verilog source files. The scanners indicate parts of code that might contain one of a set of MITRE's common weakness enumerations (CWEs). We explore the CWE database to characterize the scope and attributes of the CWEs and identify those that are amenable to static analysis. We prototype scanners and evaluate them on 11 open source designs - 4 system-on-chips (SoC) and 7 processor cores - and explore the nature of identified weaknesses. Our analysis reported 53 potential weaknesses in the OpenPiton SoC used in Hack@DAC-21, 11 of which we confirmed as security concerns.