CWE

Common Weakness Enumeration

A Community-Developed List of Software & Hardware Weakness Types

CWE Top 25 Most Dangerous Software Errors
Home > CWE List > CWE- Individual Dictionary Definition (4.0)  
ID

CWE-1233: Improper Hardware Lock Protection for Security Sensitive Controls

Weakness ID: 1233
Abstraction: Base
Structure: Simple
Status: Incomplete
Presentation Filter:
+ Description
The product implements a register lock bit protection feature that permits security sensitive controls to modify the protected configuration.
+ Extended Description

Integrated circuits and hardware IPs can expose the device configuration controls that need to be programmed after device power reset by a trusted firmware or software module (commonly set by BIOS/bootloader) and then locked from any further modification. This is commonly implemented using a trusted lock bit, which when set disables writes to a protected set of registers or address regions. The lock protection is intended to prevent modification of certain system configuration (e.g., memory/memory protection unit configuration). If any system registers/controls that can modify the protected configuration are not write-protected by the lock, they can then be leveraged by software to modify the protected configuration.

+ Relationships

The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.

+ Relevant to the view "Research Concepts" (CWE-1000)
NatureTypeIDName
ChildOfClassClass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.667Improper Locking
+ Relevant to the view "Hardware Design" (CWE-1194)
NatureTypeIDName
MemberOfCategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic.1199General Circuit and Logic Design Concerns
+ Modes Of Introduction

The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.

PhaseNote
Architecture and DesignSuch issues could be introduced during hardware architecture and design and identified later during Testing or System Configuration phases.
ImplementationSuch issues could be introduced during implementation and identified later during Testing or System Configuration phases.
+ Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

Class: Language-Independent (Undetermined Prevalence)

Operating Systems

Class: OS-Independent (Undetermined Prevalence)

Architectures

Class: Architecture-Independent (Undetermined Prevalence)

Technologies

Class: Technology-Independent (Undetermined Prevalence)

+ Common Consequences

The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.

ScopeImpactLikelihood
Access Control

Technical Impact: Modify Memory

System Configuration protected by the lock bit can be modified even when the lock is set.
+ Demonstrative Examples

Example 1

For example, consider the example design below or a digital thermal sensor used in the design to detect overheating of the silicon to trigger a system shutdown. The system critical temperature limit (CRITICAL_TEMP_LIMIT) and thermal sensor calibration (TEMP_SENSOR_CALIB) data have to be programmed by the firmware.

(bad code)
Example Language: Other 
Register Field description
CRITICAL_TEMP_LIMIT [31:8]
Reserved field;
Read only;
Default 0
[7:0]
Critical temp 0-255 Centigrade;
Read-write-lock; Default 125
TEMP_SENSOR_CALIB [31:0]
Thermal sensor calibration data. A slope value used to map sensor reading to a degree Centigrade.
Read-write;
Default 25
TEMP_SENSOR_LOCK [31:1]
Reserved field;
Read only;
Default 0 [0] Lock bit, locks CRITICAL_TEMP_LIMIT register;
Write-1-once;
Default 0
TEMP_HW_SHUTDOWN [31:2]
Reserved field;
Read only;
Default 0 [1] Enable hardware shutdown on a critical temperature detection;
Read-write;
Default 0
CURRENT_TEMP [31:8]
Reserved field;
Read only;
Default 0
[7:0]
Current Temp 0-255 Centigrade;
Read-only;
Default 0

In this example note that only the CRITICAL_TEMP_LIMIT register is protected by the TEMP_SENSOR_LOCK bit, while the security design intent is to protect any modification of the critical temperature detection and response.

The response of the system, if the system heats to a critical temperature, is controlled by TEMP_HW_SHUTDOWN bit [1], which is not lockable. Also, the TEMP_SENSOR_CALIB register is not protected by the lock bit.

By modifying the temperature sensor calibration, the conversion of the sensor data to a degree centigrade can be changed, such that the current temperature will never be detected to exceed critical temperature value programmed by the protected lock.

Similarly, by modifying the TEMP_HW_SHUTDOWN.Enable bit, the system response detection of the current temperature exceeding critical temperature can be disabled.

(informative)
 

Change TEMP_HW_SHUTDOWN and TEMP_SENSOR_CALIB controls to be locked by TEMP_SENSOR_LOCK.

TEMP_SENSOR_CALIB [31:8]
Thermal sensor calibration data. A slope value used to map sensor reading to a degree Centigrade.
Read-write-Lock;
Default 25
Locked by TEMP_SENSOR_LOCK bit[0]
TEMP_HW_SHUTDOWN [31:2]
Reserved field;
Read only;
Default 0
[1] Enable hardware shutdown on critical temperature detection;
Read-write-Lock;
Default 0
Locked by TEMP_SENSOR_LOCK bit[0]
+ Potential Mitigations

Phases: Architecture and Design; Implementation; Testing

  • Security lock bit protections must be reviewed for design inconsistency and common weaknesses.
  • Security lock bit protections must be reviewed common weaknesses.
  • Security lock programming flow and lock properties must be tested in pre-si, post-si testing.
+ Content History
Submissions
Submission DateSubmitterOrganization
2020-01-15Hareesh KhattriIntel Corporation
More information is available — Please select a different filter.
Page Last Updated: February 19, 2020