2009
Demonstrative Examples
Example 1:
Consider the example design below for a digital thermal sensor that detects overheating
of the silicon and triggers system shutdown. The system critical temperature limit
(CRITICAL_TEMP_LIMIT) and thermal sensor calibration (TEMP_SENSOR_CALIB) data have to
be programmed by firmware, and then the register needs to be locked (TEMP_SENSOR_LOCK).
Example Language: Other (Bad)
In this example, note that if the system heats to critical temperature, the response of the system
is controlled by the TEMP_HW_SHUTDOWN bit [1], which is not lockable. Thus, the intended
security property of the critical temperature sensor cannot be fully protected, since software can
misconfigure the TEMP_HW_SHUTDOWN register even after the lock bit is set to disable the
shutdown response.
Example Language: (Good)
To fix this weakness, one could change the TEMP_HW_SHUTDOWN field to be locked by TEMP_SENSOR_LOCK.
Example 2:
The following example code is a snippet from the register locks inside the buggy OpenPiton SoC of
HACK@DAC'21 [REF-1350]. Register locks help prevent SoC peripherals' registers from malicious
use of resources. The registers that can potentially leak secret data are locked by register locks.
In the vulnerable code, the reglk_mem is used for locking information. If one of its bits toggle to 1,
the corresponding peripheral's registers will be locked. In the context of the HACK@DAC Systemon-
Chip (SoC), it is pertinent to note the existence of two distinct categories of reset signals.
First, there is a global reset signal denoted as "rst_ni," which possesses the capability to
simultaneously reset all peripherals to their respective initial states.
Second, we have peripheral-specific reset signals, such as "rst_9," which exclusively reset
individual peripherals back to their initial states. The administration of these reset signals is the
responsibility of the reset controller module.
Example Language: Verilog (Bad)
always @(posedge clk_i)
begin
if(~(rst_ni && ~jtag_unlock && ~rst_9))
begin
for (j=0; j < 6; j=j+1) begin
reglk_mem[j] <= 'h0;
end
end
...
In the buggy SoC architecture during HACK@DAC'21, a critical issue arises within the reset
controller module. Specifically, the reset controller can inadvertently transmit a peripheral reset
signal to the register lock within the user privilege domain.
This unintentional action can result in the reset of the register locks, potentially exposing private
data from all other peripherals, rendering them accessible and readable.
To mitigate the issue, remove the extra reset signal rst_9 from the register lock if condition.
[REF-1351]
CWE Version 4.14
CWE-1232: Improper Lock Behavior After Power State Transition
CWE-1232: Improper Lock Behavior After Power State Transition