1991
CWE-1209: Failure to Disable Reserved Bits
Weakness ID : 1209
Structure : Simple
Abstraction : Base
Description
The reserved bits in a hardware design are not disabled prior to production. Typically, reserved bits
are used for future capabilities and should not support any functional logic in the design. However,
designers might covertly use these bits to debug or further develop new capabilities in production
hardware. Adversaries with access to these bits will write to them in hopes of compromising
hardware state.
Extended Description
Reserved bits are labeled as such so they can be allocated for a later purpose. They are not to
do anything in the current design. However, designers might want to use these bits to debug
or control/configure a future capability to help minimize time to market (TTM). If the logic being
controlled by these bits is still enabled in production, an adversary could use the logic to induce
unwanted/unsupported behavior in the hardware.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 710 Improper Adherence to Coding Standards 1549
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : System on Chip (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Access Control
Accountability
Authentication
Authorization
Non-Repudiation
Varies by Context
This type of weakness all depends on the capabilities of
the logic being controlled or configured by the reserved bits
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
Include a feature to disable reserved bits.
Phase: Integration
CWE Version 4.14
CWE-1220: Insufficient Granularity of Access Control
CWE-1220: Insufficient Granularity of Access Control