BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.2.1.3 Non-Bypassability

NIST platform security: roots of trust, firmware and secure enclaves SP 800-193
All changes in this version
first version loaded 4 Firmware Security Guidelines for Platform Devices part of 4.2.1

Title

Non-Bypassability

Control

The principle of non-bypassability is that it should not be possible for an attacker to modify device firmware outside of the authenticated update mechanism or, if supported, a secure local update. Any intended or unintended mechanisms capable of bypassing the authenticated update mechanism could create a vulnerability allowing malicious software to modify device firmware with a malicious or invalid image. These could include development or diagnostic interfaces that allow access to flash regions, architectural features that allow direct memory access, or low-level vulnerabilities that allow manipulation of memory (e.g., rowhammer attacks).

To satisfy the principle of non-bypassability, these potential vulnerabilities need to be considered in overall system design. This could include efforts to limit the attack surface of devices, careful analysis of interfaces to devices and non-standard command sets, and disabling development and diagnostic interfaces in production devices.

1) The protection mechanisms shall ensure that authenticated update mechanisms are not bypassed. 2) The authenticated update mechanism shall be capable of preventing unauthorized updates of the device firmware to an earlier authentic version that has a security weakness or would enable updates to a version with a known security weakness. Note: Updates to earlier firmware versions, sometimes called “rollback,” may provide a means to recover from a firmware update that is not functioning correctly. However, unauthorized rollback could allow an attacker to restore a vulnerable firmware image, which in turn could allow the attacker to damage the device or inject malware. As such, devices that support rollback should include appropriate security controls to ensure it cannot be exploited by an unauthorized entity in an attack.