CWE-1222 describes a design that protects a large address region from modification with a single register lock control bit. That creates a conflict. Some addresses must stay writable by software during operation, but the lock bit must be set during boot for security.
It applies to integrated circuit and hardware IP designers.
How it happens
Hardware often exposes configuration controls that trusted firmware or software, commonly the BIOS or bootloader, programs after reset and then locks. A programmable lock bit enables or disables writes to a protected set of registers or address regions. Once set, the region behaves as if it were a hardcoded value that cannot change.
The problem is granularity. If the region is too large, it can contain registers that software legitimately needs to write later. After the lock is set, that new functionality cannot be implemented without changing the hardware design.
What an attacker gains
This weakness is more about design conflict than attack. MITRE's stated consequence is that system security configuration cannot be defined in a way that avoids conflict with the functional requirements of the device. The likely result is pressure to leave the lock off, which removes the protection.
How to find it
The record has no detection methods. Compare each locked region against the register map and list what software needs to write after boot.
How to fix it
MITRE recommends two things.
- Review or test the definition of protected locked registers early in the design phase, with software teams, so software flows are not blocked by the security locks.
- As an alternative to register lock control bits and fixed access control regions, use programmable security access control configuration, so trusted firmware can configure and change the protected regions based on software usage and security models.
Quick check
Why involve software teams early?
To confirm that required software flows are not blocked by the locks, before the design is frozen in hardware.
