1998
if (~resetn)
begin
Data_out <= REGISTER_DEFAULT; // Register content set to Default at reset
Secure_mode <= REGISTER_DEFAULT[0]; // Register Secure_mode set at reset
end
else if (write & ~Secure_mode)
begin
Data_out <= Data_in;
end
endmodule
module register_top
(
input Clk,
input resetn,
input write,
input [31:0] Data_in,
output reg [31:0] Secure_reg,
output reg [31:0] Insecure_reg
);
register_example #(
.REGISTER_WIDTH (32),
.REGISTER_DEFAULT (1224) // Incorrect Default value used bit 0 is 0.
) Insecure_Device_ID_1 (
.Data_in (Data_in),
.Data_out (Secure_reg),
.Clk (Clk),
.resetn (resetn),
.write (write)
);
register_example #(
.REGISTER_WIDTH (32) // Default not defined 2^32-2 value will be used as default.
) Insecure_Device_ID_2 (
.Data_in (Data_in),
.Data_out (Insecure_reg),
.Clk (Clk),
.resetn (resetn),
.write (write)
);
endmodule
These example instantiations show how, in a hardware design, it would be possible to instantiate
the register module with insecure defaults and parameters.
In the example design, both registers will be software writable since Secure_mode is defined as
zero.
Example Language: Verilog (Good)
register_example #(
.REGISTER_WIDTH (32),
.REGISTER_DEFAULT (1225) // Correct default value set, to enable Secure_mode
) Secure_Device_ID_example (
.Data_in (Data_in),
.Data_out (Secure_reg),
.Clk (Clk),
.resetn (resetn),
.write (write)
);
Example 2:
The example code is taken from the fuse memory inside the buggy OpenPiton SoC of
HACK@DAC'21 [REF-1356]. Fuse memory can be used to store key hashes, password hashes,
and configuration information. For example, the password hashes of JTAG and HMAC are stored in
the fuse memory in the OpenPiton design.
CWE Version 4.14
CWE-1222: Insufficient Granularity of Address Regions Protected by Register Locks
CWE-1222: Insufficient Granularity of Address
Regions Protected by Register Locks