CWE-1281 covers specific combinations of processor instructions that lead to undesirable behavior, such as locking the processor until a hard reset is performed. It is a processor design weakness with availability consequences for everything above it.
How it happens
If the instruction set architecture and processor logic are not designed carefully and tested thoroughly, certain combinations of instructions can lock the processor or cause other unwanted behavior. When a processor meets an unimplemented opcode or an illegal operand, it should raise an exception and carry on without harming security. The weakness appears when specific combinations of legal and illegal instructions break that rule, for example allowing unprivileged programs to lock the CPU completely.
Two recorded cases show the pattern.
- CVE-2021-26339: a bug in AMD CPU core logic allows a potential denial of service by using a specific x86 instruction sequence to hang the processor.
- CVE-1999-1476: some Intel Pentium processors allow denial of service through an invalid CMPXCHG8B instruction, causing a deadlock.
What an attacker gains
Integrity and availability impact, varying by context. The practical result in both cases is a hung machine.
How to find it
The record lists no detection methods. On the design side, test beyond valid programs: exercise unimplemented opcodes and illegal operands in combination with legal instructions, and confirm that every one ends in a clean exception.
On the operations side, you cannot fix silicon, but you can know where it runs. Keep an inventory of processors in your fleet so that when a hardware advisory lands you can tell which systems are affected, and apply the vendor's fix when one exists.
How to fix it
- Specify exactly what must happen on every illegal instruction or operand.
- Test instruction combinations, not only single instructions.
- For deployed systems, track processor advisories and apply vendor updates.
Quick check
What should a processor do on an illegal opcode?
Throw an exception and carry on without negatively affecting security.
