Exploring the Coverage of Existing Hardware Vulnerabilities in Community Standards

Abstract

Hardware security vulnerabilities have taken on greater importance over the last decade as academic and industry research has brought the issue to the forefront. The scope and breadth of these vulnerabilities have made them difficult to classify as has been done for software and network systems with the well-known Common Vulnerabilities and Exposures (CVE) database maintained by the MITRE Corporation. As further hardware security research continues, there is a requirement to standardize the language and references of academics, industry, and government alike. Without this common lexicon it becomes exceedingly difficult and potentially confusing when exchanging ideas, concepts, and methodologies across various sectors. Building and maintaining a glossary of terms, concepts, and concerns allows for a focus towards further research and development in the field of hardware security. In this paper, we review the nascent efforts by academia and industry in categorizing and documenting the existing hardware security landscape. The contributions of our work is an examination of the existing community efforts in the classification of hardware weakness with a specific focus on the CWE database. While current efforts are helping to contour the hardware landscape, similar to the work already performed for software and networks, the field is still evolving, and more work is required.