Détail du CWE-1232

Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected registers or lock bits become programmable after power state transitions (e.g., Entry and wake from low power sleep modes) causing the system configuration to be changeable.

Devices may allow device configuration controls which need to be programmed after device power reset via a trusted firmware or software module (commonly set by BIOS/bootloader) and then locked from any further modification. This action is commonly implemented using a programmable lock bit, which, when set, disables writes to a protected set of registers or address regions.

After a power state transition, the lock bit is set to unlocked. Some common weaknesses that can exist in such a protection scheme are that the lock gets cleared, the values of the protected registers get reset, or the lock become programmable.

Modes d'introduction

Architecture and Design
Implementation

Plateformes applicables

Langue

Class: Not Language-Specific (Undetermined)

Systèmes d’exploitation

Class: Not OS-Specific (Undetermined)

Architectures

Class: Not Architecture-Specific (Undetermined)

Technologies

Class: Not Technology-Specific (Undetermined)

Conséquences courantes

Mesures d’atténuation potentielles

Phases : Architecture and Design // Implementation // Testing

• Security Lock bit protections should be reviewed for behavior across supported power state transitions.
• Security lock programming flow and lock properties should be tested in pre-silicon and post-silicon testing including testing across power transitions.

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Modèles d'attaque associés

Références

REF-1432

reglk_wrapper.sv
https://github.com/HACK-EVENT/hackatdac21/blob/65d0ffdab7426da4509c98d62e163bcce642f651/piton/design/chip/tile/ariane/src/reglk/reglk_wrapper.sv#L39C1-L39C1

REF-1433

Bad Code reglk_wrapper.sv
https://github.com/HACK-EVENT/hackatdac21/blob/65d0ffdab7426da4509c98d62e163bcce642f651/piton/design/chip/tile/ariane/src/reglk/reglk_wrapper.sv#L78C1-L85C16

REF-1434

Good Code reglk_wrapper.sv
https://github.com/HACK-EVENT/hackatdac21/blob/5e2031fd3854bcc0b2ca11d13442542dd5ea98e0/piton/design/chip/tile/ariane/src/reglk/reglk_wrapper.sv#L83

Soumission

Modifications