Weakness (CWE)
CWE-1223: Race Condition for Write-Once Attributes
A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted software component, resulting in a race condition issue.
More detail
Implementation issues in hardware design of such controls can expose such registers to a race condition security flaw.
For example, consider a hardware design that has two different software/firmware modules executing in parallel. One module is trusted (module A) and another is untrusted (module B). In this design, it could be possible for Module B to send write cycles to the write-once register before Module A. Since the field is write-once, the programmed value from Module A will be ignored and the pre-empted value programmed by Module B will be used by hardware.
How to prevent it (1 mitigation)
-
Architecture and Design
During hardware design, all register write-once or sticky fields must be evaluated for proper configuration.
Source: MITRE CWE-1223
0 results · Clear filters · Feed