ES2605-344c2eea - Add relationships to certain hardware CWEs

[stevechristeycoley]

Submission File: ES2605-344c2eea-mod-hw-CWE-rels.txt

ID: ES2605-344c2eea

SUBMISSION DATE: 2026-05-13 19:35:33

NAME: Add relationships to certain hardware CWEs

DESCRIPTION:

Background - Through a recent third-party IP (3PIP) assurance project,
we have reviewed HW CWEs in extensive detail and identified several
overlaps.

Source of Confusion - The root cause for many CWEs ended up being
interpreted to be the same, which resulted in re-use of verification
data for multiple CWEs.

Recommendation - Possible improvements to the Relationship entries to
clarify these similarities.

Recommendations

1. CWE-1220: Insufficient Granularity of Access Control

CWE-1262, CWE-1299, and CWE-1222

Make all ChildOf of CWE-1220 (CWE-1222 is already a child of CWE-1220)

There was a lot of disucssion on this one since this deals with
Access Control.

2. CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface

Create a PeerOf relationship between CWE-1262 and CWE-1299

3. CWE-1303: Non-Transparent Sharing of Microarchitectural Resources

Add PeerOf or CanAlsoBe realstionship between CWE-1303 and CWE-1421

CWE entries can have relationship notes that we can use to compare
and contrast CWEs. For this one we may want to clarify so people
won't pick the wrong CWE.

4. CWE-1272: Sensitive Information Uncleared Before Debug/Power State
   Transition

• Make CWE-1258 a ChildOf CWE-1272

• Add CWE-1239 a CanAlsoBe relationship to both CWE-1272 and CWE-1258

5. CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation

• Make CWE-1431 a ChildOf CWE-325

• Make CWE-1431 a PeerOf CWE-1420 and maybe CWE-1258? (via Jason Fung)

[RushiP-MITRE]

This submission has been accepted (Phase 6) and will move to a new stage. This means that the CWE Team has agreed to make the suggested change(s) to the relevant CWE entry/entries and include this change in an upcoming version.

• If we need to obtain additional details or work closely on finalizing changes before modifying the CWE entry/entries, we will move to Stage 2, Phase 7: Det-Sub-Requested.

• If no further changes are needed, then we will move to Stage 3, Phase 12: Internal-Update, where we will begin to modify CWE content directly.

You should receive notification about the next phase change shortly.

[stevechristeycoley]

This submission has now moved into Stage 3, Phase 12: Internal-Update. A CWE analyst will make the suggested change(s) to the relevant CWE entry, and these changes will be included in the next release. There might be additional inquiries or status updates in the coming weeks.