CWE-1232 covers register lock protection that stops holding after a power state transition. Entering or waking from low power sleep modes leaves some protected registers or lock bits programmable again, so the system configuration can be changed. It concerns hardware designers and the firmware that relies on their locks.
How it happens
Devices let trusted firmware, commonly the BIOS or bootloader, program configuration controls after reset and then lock them with a programmable lock bit. That bit disables writes to a protected set of registers or address regions.
The assumption behind the design is that the lock stays set until the next full reset. Power state transitions break that assumption. MITRE notes that after a transition the lock bit may be set back to unlocked. Several things can go wrong: the lock gets cleared, the values of protected registers get reset, or the lock becomes programmable.
A locked configuration that does not survive a sleep and wake cycle is exposed every time the device suspends.
What an attacker gains
The record lists an access control impact with the ability to modify memory, rated high. The protected configuration can be changed after a transition.
How to find it
The record has no separate detection methods. Use the mitigation as a test plan: exercise every supported power state transition, then confirm the lock bit and the protected registers are in the expected state afterward.
How to fix it
MITRE's mitigation, rated high effectiveness, covers design, implementation and testing. Review lock bit protections for their behavior across all supported power state transitions. Test the lock programming flow and lock properties in pre-silicon and post-silicon testing, including testing across power transitions.
Quick check
What can change after a power state transition?
The lock can get cleared, the values of protected registers can be reset, or the lock can become programmable.
