2011
locked from any further modification. This action is commonly implemented using a programmable
lock bit, which, when set, disables writes to a protected set of registers or address regions.
After a power state transition, the lock bit is set to unlocked. Some common weaknesses that
can exist in such a protection scheme are that the lock gets cleared, the values of the protected
registers get reset, or the lock become programmable.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 667 Improper Locking 1464
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Modify Memory High
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
Phase: Testing
Security Lock bit protections should be reviewed for behavior across supported power state
transitions. Security lock programming flow and lock properties should be tested in pre-silicon
and post-silicon testing including testing across power transitions.
Effectiveness = High
Demonstrative Examples
Example 1:
Consider the memory configuration settings of a system that uses DDR3 DRAM memory.
Protecting the DRAM memory configuration from modification by software is required to ensure that
system memory access control protections cannot be bypassed. This can be done by using lock bit
protection that locks all of the memory configuration registers. The memory configuration lock can
be set by the BIOS during the boot process.
If such a system also supports a rapid power on mode like hibernate, the DRAM data must be
saved to a disk before power is removed and restored back to the DRAM once the system powers
back up and before the OS resumes operation after returning from hibernate.
To support the hibernate transition back to the operating state, the DRAM memory configuration
must be reprogrammed even though it was locked previously. As the hibernate resume does
a partial reboot, the memory configuration could be altered before the memory lock is set.
Functionally the hibernate resume flow requires a bypass of the lock-based protection. The
CWE Version 4.14
CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit Protection
CWE-1233: Security-Sensitive Hardware
Controls with Missing Lock Bit Protection 2012
memory configuration must be securely stored and restored by trusted system firmware. Lock
settings and system configuration must be restored to the same state it was in before the device
entered into the hibernate mode.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1199 General Circuit and Logic Design Concerns 1194 2471
MemberOf 1206 Power, Clock, Thermal, and Reset Concerns 1194 2473
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Related Attack Patterns
CAPEC-ID Attack Pattern Name
166 Force the System to Reset Values
CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit
Protection
Weakness ID : 1233
Structure : Simple
Abstraction : Base
Description
The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit
prevents modification of system registers or controls that perform changes to important hardware
system configuration.
Extended Description
Integrated circuits and hardware intellectual properties (IPs) might provide device configuration
controls that need to be programmed after device power reset by a trusted firmware or software
module, commonly set by BIOS/bootloader. After reset, there can be an expectation that
the controls cannot be used to perform any further modification. This behavior is commonly
implemented using a trusted lock bit, which can be set to disable writes to a protected set of
registers or address regions. The lock protection is intended to prevent modification of certain
system configuration (e.g., memory/memory protection unit configuration).
However, if the lock bit does not effectively write-protect all system registers or controls that could
modify the protected system configuration, then an adversary may be able to use software to
access the registers/controls and modify the protected hardware configuration.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 667 Improper Locking 1464
ChildOf 284 Improper Access Control 680
Weakness Ordinalities
CWE Version 4.14
CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit Protection
CWE-1233: Security-Sensitive Hardware
Controls with Missing Lock Bit Protection