CWE-1224 describes hardware control registers whose "sticky bits" or write-once bit fields are implemented incorrectly, so software can reprogram them. It is a design flaw for IC and hardware IP teams.
How it happens
Hardware settings are stored in registers that take hardcoded default values at reset. A frequent protection is to make a setting write-once, or sticky. After one write the register becomes read-only. That lets early boot software choose secure values and blocks runtime software from changing them.
If the restriction is implemented wrongly, the register can be written multiple times. MITRE gives a precise example: a field implemented to be write protected only after it has been set to the value 1 behaves as "write-1-once" and not "write-once". Writing a zero leaves it open to further changes.
That is a small logic slip with a large effect. The field looks locked in testing that only writes ones.
What an attacker gains
The record states that system configuration cannot be programmed in a secure way, with impact varying by context across confidentiality, integrity, availability and access control.
How to find it
MITRE lists automated analysis. Use automated tools to test that values are not reprogrammable and that write-once fields lock when zeros are written. In other words, test the zero case on purpose.
How to fix it
During hardware design, evaluate all register write-once or sticky fields for proper configuration. Write a test for each field that attempts a second write with both zero and one, and confirm the first value holds.
Quick check
What is the difference between write-once and write-1-once?
A write-once field locks after any first write. A write-1-once field locks only if the value written was 1, so writing 0 leaves it changeable.
