2013
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Modify Memory
System Configuration protected by the lock bit can be
modified even when the lock is set.
Detection Methods
Manual Analysis
Set the lock bit. Attempt to modify the information protected by the lock bit. If the information is
changed, implement a design fix. Retest. Also, attempt to indirectly clear the lock bit or bypass it.
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
Phase: Testing
Security lock bit protections must be reviewed for design inconsistency and common
weaknesses. Security lock programming flow and lock properties must be tested in pre-silicon
and post-silicon testing.
Demonstrative Examples
Example 1:
Consider the example design below for a digital thermal sensor that detects overheating
of the silicon and triggers system shutdown. The system critical temperature limit
(CRITICAL_TEMP_LIMIT) and thermal sensor calibration (TEMP_SENSOR_CALIB) data have to
be programmed by the firmware.
Example Language: Other (Bad)
In this example note that only the CRITICAL_TEMP_LIMIT register is protected by the
TEMP_SENSOR_LOCK bit, while the security design intent is to protect any modification of the
critical temperature detection and response.
The response of the system, if the system heats to a critical temperature, is controlled by
TEMP_HW_SHUTDOWN bit [1], which is not lockable. Also, the TEMP_SENSOR_CALIB register
is not protected by the lock bit.
By modifying the temperature sensor calibration, the conversion of the sensor data to a degree
centigrade can be changed, such that the current temperature will never be detected to exceed
critical temperature value programmed by the protected lock.
Similarly, by modifying the TEMP_HW_SHUTDOWN.Enable bit, the system response detection of
the current temperature exceeding critical temperature can be disabled.
CWE Version 4.14
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks