2014
Example Language: (Good)
Change TEMP_HW_SHUTDOWN and TEMP_SENSOR_CALIB controls to be locked by TEMP_SENSOR_LOCK.
Observed Examples
Reference Description
CVE-2018-9085 Certain servers leave a write protection lock bit unset after boot, potentially
allowing modification of parts of flash memory.
https://www.cve.org/CVERecord?id=CVE-2018-9085
CVE-2014-8273 Chain: chipset has a race condition (CWE-362) between when an interrupt
handler detects an attempt to write-enable the BIOS (in violation of the lock
bit), and when the handler resets the write-enable bit back to 0, allowing
attackers to issue BIOS writes during the timing window [REF-1237].
https://www.cve.org/CVERecord?id=CVE-2014-8273
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1199 General Circuit and Logic Design Concerns 1194 2471
MemberOf 1343 Weaknesses in the 2021 CWE Most Important
Hardware Weaknesses List
1343 2592
MemberOf 1372 ICS Supply Chain: OT Counterfeit and Malicious
Corruption
1358 2509
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
176 Configuration/Environment Manipulation
680 Exploitation of Improperly Controlled Registers
References
[REF-1237]CERT Coordination Center. "Intel BIOS locking mechanism contains race condition that
enables write protection bypass". 2015 January 5. < https://www.kb.cert.org/vuls/id/766164/ >.
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks
Weakness ID : 1234
Structure : Simple
Abstraction : Base
Description
System configuration protection may be bypassed during debug mode.
Extended Description
Device configuration controls are commonly programmed after a device power reset by a
trusted firmware or software module (e.g., BIOS/bootloader) and then locked from any further
modification. This is commonly implemented using a trusted lock bit, which when set, disables
writes to a protected set of registers or address regions. The lock protection is intended to prevent
modification of certain system configuration (e.g., memory/memory protection unit configuration).
If debug features supported by hardware or internal modes/system states are supported in
CWE Version 4.14
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks