Weakness (CWE)
CWE-1223: Race Condition for Write-Once Attributes
A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted software component, resulting in a race condition issue.
More detail
Implementation issues in hardware design of such controls can expose such registers to a race condition security flaw.
For example, consider a hardware design that has two different software/firmware modules executing in parallel. One module is trusted (module A) and another is untrusted (module B). In this design, it could be possible for Module B to send write cycles to the write-once register before Module A. Since the field is write-once, the programmed value from Module A will be ignored and the pre-empted value programmed by Module B will be used by hardware.
How to prevent it (1 mitigation)
-
Architecture and Design
During hardware design, all register write-once or sticky fields must be evaluated for proper configuration.
Source: MITRE CWE-1223
3 results · Feed
-
High 8.8
IBM MQ Race Condition
IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.
-
Medium 4.0
In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This coul…
-
High 8.8
A race condition was identified through which privilege escalation was possible in certain configurations.