1996
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1198 Privilege Separation and Access Control Issues 1194 2470
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
1 Accessing Functionality Not Properly Constrained by ACLs
180 Exploiting Incorrectly Configured Access Control Security Levels
References
[REF-1346]"axi_node_intf_wrap.sv". 2019. < https://github.com/HACK-EVENT/
hackatdac19/blob/619e9fb0ef32ee1e01ad76b8732a156572c65700/src/axi_node/src/
axi_node_intf_wrap.sv#L430 >.2023-09-18.
[REF-1347]"axi_node_intf_wrap.sv". 2019. < https://github.com/HACK-EVENT/hackatdac19/
blob/2078f2552194eda37ba87e54cbfef10f1aa41fa5/src/axi_node/src/axi_node_intf_wrap.sv#L430
>.2023-09-18.
CWE-1221: Incorrect Register Defaults or Module Parameters
Weakness ID : 1221
Structure : Simple
Abstraction : Base
Description
Hardware description language code incorrectly defines register defaults or hardware Intellectual
Property (IP) parameters to insecure values.
Extended Description
Integrated circuits and hardware IP software programmable controls and settings are commonly
stored in register circuits. These register contents have to be initialized at hardware reset to
defined default values that are hard coded in the hardware description language (HDL) code of
the hardware unit. Hardware descriptive languages also support definition of parameter variables,
which can be defined in code during instantiation of the hardware IP module. Such parameters are
generally used to configure a specific instance of a hardware IP in the design.
The system security settings of a hardware design can be affected by incorrectly defined default
values or IP parameters. The hardware IP would be in an insecure state at power reset, and this
can be exposed or exploited by untrusted software running on the system. Both register defaults
and parameters are hardcoded values, which cannot be changed using software or firmware
patches but must be changed in hardware silicon. Thus, such security issues are considerably
more difficult to address later in the lifecycle. Hardware designs can have a large number of such
parameters and register defaults settings, and it is important to have design tool support to check
these settings in an automated way and be able to identify which settings are security sensitive.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
CWE Version 4.14
CWE-1221: Incorrect Register Defaults or Module Parameters
CWE-1221: Incorrect Register Defaults or Module Parameters