CWE-1271 covers security critical logic that is not set to a known value on reset. Hardware designers working in Verilog or VHDL are the main audience, though firmware authors feel the effects.
How it happens
When a device comes out of reset, any register the logic has not initialized holds an indeterminate value. Until those registers are initialized, there is a window where the device is in an insecure state. An attacker who acts inside that window may find locks open or checks disabled.
What an attacker gains
The recorded consequences fall under access control, authentication and authorization, and vary by context. In practice, the attacker gets whatever the uninitialized setting was meant to guard.
How to find it
The record gives no detection methods. Review the reset behavior of every register that holds a security setting, and check in simulation that each reaches a defined, safe value immediately after reset. Pay attention to registers that look unimportant but gate access.
How to fix it
- Give every security relevant register an explicit reset value.
- Choose the safe value, which usually means locked or denied.
- Do not release the rest of the system from reset until security logic is initialized.
- Add reset state checks to your verification suite.
Quick check
Why is the window dangerous even if it is short?
An attacker only needs the device to be in an insecure state once. The state is indeterminate, so you cannot assume it is safe.
