2015
the hardware design, modification of the lock protection may be allowed allowing access and
modification of configuration information.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 667 Improper Locking 1464
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Bypass of lock bit allows access and modification of
system configuration even when the lock bit is set.
High
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
Phase: Testing
Security Lock bit protections should be reviewed for any bypass/override modes supported. Any
supported override modes either should be removed or protected using authenticated debug
modes. Security lock programming flow and lock properties should be tested in pre-silicon and
post-silicon testing.
Effectiveness = High
Demonstrative Examples
Example 1:
For example, consider the example Locked_override_register example. This register module
supports a lock mode that blocks any writes after lock is set to 1.
However, it also allows override of the lock protection when scan_mode or debug_unlocked modes
are active.
Example Language: Verilog (Bad)
module Locked_register_example
(
input [15:0] Data_in,
input Clk,
input resetn,
input write,
input Lock,
input scan_mode,
input debug_unlocked,
output reg [15:0] Data_out
CWE Version 4.14
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks