CWE-1209 describes hardware designs where the reserved bits are not disabled before production. It is a concern for chip designers and for teams that review designs before tape out.
How it happens
Reserved bits are labeled that way so they can be allocated later. They are not supposed to support any functional logic in the current design. MITRE notes that designers may use them anyway, to debug or to control a future capability and cut time to market.
If the logic those bits control is still enabled in production, an adversary with access to the bits can write to them in hopes of compromising hardware state and induce unwanted or unsupported behavior.
What an attacker gains
The record says it depends entirely on the capabilities of the logic the bits configure, and lists a range of possible effects across confidentiality, integrity, availability, access control and authorization.
How to find it
The record has no detection methods. Compare the design specification against the implemented register map and ask what every bit marked reserved actually connects to.
How to fix it
MITRE recommends three steps:
- During design and implementation, include a feature to disable reserved bits.
- During integration, make sure writes to reserved bits are blocked, whether ignored, access protected or answered with an exception.
- Treat any logic behind a reserved bit as a finding to remove before production.
Quick check
Why would a designer use a reserved bit?
To debug or configure a future capability and minimize time to market. The risk is leaving that logic enabled in production.
