CWE-1234 covers hardware where system configuration protection can be bypassed during debug mode. It matters to designers who add debug or internal modes for engineering convenience and ship them to customers.
How it happens
Device configuration controls are typically programmed after reset by trusted firmware, such as the BIOS or bootloader, and then locked against modification with a trusted lock bit. The lock protects things like memory or memory protection unit configuration.
If the hardware supports debug features or other internal modes or system states, those modes may be allowed to modify the lock protection. That gives access to configuration information and lets it be changed. The lock works in normal operation and is overridden in the special mode.
What an attacker gains
MITRE lists a bypass of a protection mechanism, rated high. Bypassing the lock bit allows access to and modification of system configuration even when the lock bit is set.
How to find it
The record has no detection methods. Make an inventory of every debug feature and internal mode, and for each one try to write locked registers. Include states reachable through a physical debug port.
How to fix it
MITRE's mitigation, rated high effectiveness, covers design, implementation and testing.
- Review security lock bit protections for any bypass or override modes supported.
- Remove any supported override modes, or protect them with authenticated debug modes.
- Test the lock programming flow and lock properties in pre-silicon and post-silicon testing.
This pairs naturally with the access control on debug interfaces described in CWE-1191.
Quick check
Which is better, removing an override mode or authenticating it?
MITRE lists both: either remove supported override modes, or protect them with authenticated debug modes.
