CWE-1221 is about hardware description language (HDL) code that sets register defaults or hardware IP parameters to insecure values. It is a concern for hardware designers writing Verilog or VHDL, and for security reviewers who read their work.
How it happens
Integrated circuits store software programmable controls and settings in registers. At reset, those registers take default values that are hard coded in the HDL. Hardware languages also support parameters, which configure a specific instance of a hardware IP when it is instantiated.
If a default or parameter is wrong, the IP is in an insecure state at power reset, and untrusted software running on the system can expose or exploit it.
The cost of the mistake is what sets this apart from software. Register defaults and parameters are hardcoded, so they cannot be changed by a software or firmware patch. They must be changed in the silicon, which makes these problems far harder to address later in the lifecycle. MITRE adds that designs can have a large number of such settings, so design tool support is important for checking them automatically and for identifying which are security sensitive.
What an attacker gains
The record describes degradation of system functionality, or loss of access control enforcement, with effects that vary by context across confidentiality, integrity, availability and access control.
How to find it
MITRE lists automated analysis: use tools to test that values are configured per the design specifications. Start by producing an inventory of every register default and parameter, flagged by whether it affects security.
How to fix it
MITRE splits the mitigation across two phases.
- During architecture and design, review all system parameters and register defaults to identify security sensitive settings.
- During implementation, define the default values of those security sensitive settings as part of the design review phase.
Do this before tape out. After that, the only fix is new silicon.
Quick check
Why can't firmware fix a bad register default?
Register defaults and parameters are hardcoded in the hardware, so they must be changed in silicon and cannot be changed by a software or firmware patch.
