CWE-1232: Improper Lock Behavior After Power State Transition
The product implements register lock bit protection features with the intent to disable changes to system configuration after the lock is set. Some of the protected registers or lock bits become programmable after power state transitions (e.g., Entry and wake from low power sleep modes).
Integrated circuits and hardware IPs can expose the device configuration controls that need to be programmed after device power reset by a trusted firmware or software module (commonly set by BIOS/bootloader) and then locked from any further modification. In hardware design this is commonly implemented using a programmable lock bit, which when set disables writes to a protected set of registers or address regions.
Some common weaknesses that can exist in such a protection scheme is that the lock gets cleared, the values of the protected registers get reset, or the lock become programmable after a power state transition.
The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
Relevant to the view "Research Concepts" (CWE-1000)
Relevant to the view "Hardware Design" (CWE-1194)
The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.
Class: Language-Independent (Undetermined Prevalence)
Class: OS-Independent (Undetermined Prevalence)
Class: Architecture-Independent (Undetermined Prevalence)
Class: Technology-Independent (Undetermined Prevalence)
The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
Consider memory configuration settings of a system that uses DDR3 DRAM memory. Protecting the DRAM memory configuration from modification by software is required to ensure that system memory access control protections cannot be bypassed. This can be done by using a lock bit protection that locks all memory configuration registers. The memory configuration lock can be set by BIOS on boot.
If such a system also supports a low power sleep state like hibernate, the DRAM data must be saved in disk and restored when system resumes from hibernate. During hibernate, system DRAM would be powered off.
To support hibernate power transition flow, the DRAM memory configuration must be reprogrammed even though it was locked previously. During hibernate resume, the memory configuration could be modified or memory lock cleared.
Functionally the hibernate resume flow requires a bypass of the lock-based protection.
The memory configuration must be securely stored and restored by trusted system firmware. Lock settings and system configuration must be restored to same state as before entry to hibernate mode.
More information is available — Please select a different filter.