1999
During the firmware setup phase, data in the Fuse memory are transferred into the registers of
the corresponding SoC peripherals for initialization. However, if the offset to access the password
hash is set incorrectly, programs cannot access the correct password hash from the fuse memory,
breaking the functionalities of the peripherals and even exposing sensitive information through
other peripherals.
Example Language: Verilog (Bad)
parameter MEM_SIZE = 100;
localparam JTAG_OFFSET = 81;
const logic [MEM_SIZE-1:0][31:0] mem = {
// JTAG expected hamc hash
32'h49ac13af, 32'h1276f1b8, 32'h6703193a, 32'h65eb531b,
32'h3025ccca, 32'h3e8861f4, 32'h329edfe5, 32'h98f763b4,
...
assign jtag_hash_o = {mem[JTAG_OFFSET-1],mem[JTAG_OFFSET-2],mem[JTAG_OFFSET-3],
mem[JTAG_OFFSET-4],mem[JTAG_OFFSET-5],mem[JTAG_OFFSET-6],mem[JTAG_OFFSET-7],mem[JTAG_OFFSET-8]};
...
The following vulnerable code accesses the JTAG password hash from the fuse memory. However,
the JTAG_OFFSET is incorrect, and the fuse memory outputs the wrong values to jtag_hash_o.
Moreover, setting incorrect offset gives the ability to attackers to access JTAG by knowing other
low-privileged peripherals' passwords.
To mitigate this, change JTAG_OFFSET to the correct address of the JTAG key [REF-1357].
Example Language: Verilog (Good)
parameter MEM_SIZE = 100;
localparam JTAG_OFFSET = 100;
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1199 General Circuit and Logic Design Concerns 1194 2471
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Related Attack Patterns
CAPEC-ID Attack Pattern Name
166 Force the System to Reset Values
References
[REF-1356]"fuse_mem.sv". 2021. < https://github.com/HACK-EVENT/hackatdac21/blob/main/piton/
design/chip/tile/ariane/src/fuse_mem/fuse_mem.sv#L14-L15 >.2023-07-15.
[REF-1357]"fix CWE 1221 in fuse_mem.sv". 2021. < https://github.com/
HACK-EVENT/hackatdac21/compare/main...cwe_1221_in_fuse_mem#diffd7275edeac22f76691a31c83f005d0177359ad710ad6549ece3d069ed043ef21
>.2023-07-24.
CWE-1222: Insufficient Granularity of Address Regions Protected by Register
Locks
Weakness ID : 1222
Structure : Simple
CWE Version 4.14
CWE-1222: Insufficient Granularity of Address Regions Protected by Register Locks
CWE-1222: Insufficient Granularity of Address
Regions Protected by Register Locks 2000
Abstraction : Variant
Description
The product defines a large address region protected from modification by the same register
lock control bit. This results in a conflict between the functional requirement that some addresses
need to be writable by software during operation and the security requirement that the system
configuration lock bit must be set during the boot process.
Extended Description
Integrated circuits and hardware IPs can expose the device configuration controls that need to
be programmed after device power reset by a trusted firmware or software module (commonly
set by BIOS/bootloader) and then locked from any further modification. In hardware design, this
is commonly implemented using a programmable lock bit which enables/disables writing to a
protected set of registers or address regions. When the programmable lock bit is set, the relevant
address region can be implemented as a hardcoded value in hardware logic that cannot be
changed later.
A problem can arise wherein the protected region definition is not granular enough. After the
programmable lock bit has been set, then this new functionality cannot be implemented without
change to the hardware design.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1220 Insufficient Granularity of Access Control 1992
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : System on Chip (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Other
System security configuration cannot be defined in a
way that does not conflict with functional requirements of
device.
Potential Mitigations
Phase: Architecture and Design
The defining of protected locked registers should be reviewed or tested early in the design
phase with software teams to ensure software flows are not blocked by the security locks. As
an alternative to using register lock control bits and fixed access control regions, the hardware
design could use programmable security access control configuration so that device trusted
firmware can configure and change the protected regions based on software usage and security
models.
Demonstrative Examples
CWE Version 4.14
CWE-1223: Race Condition for Write-Once Attributes
CWE-1223: Race Condition for Write-Once Attributes