CWE-1283 covers register contents used for attestation or measurement reporting that an adversary can modify. It affects SoC teams building secure or verified boot.
How it happens
During secure boot, the SoC often measures the code it authenticates. It hashes the code binary with a secure one-way hash and extends the result onto the previous hash. The final value, after boot completes, is the measurement used for reporting or attestation.
That hash is commonly held in registers that another party can read later to check whether the boot flow was tampered with. The weakness is that an adversary can modify those registers and spoof the measurement.
What an attacker gains
The record lists confidentiality impact through reading memory and application data. The deeper damage is trust: a verifier is told the boot was clean when it was not.
How to find it
No detection methods are listed. Check the access permissions on each measurement register and attempt writes from every agent that is not part of the boot measurement chain.
How to fix it
- Make measurement registers writable only by the trusted measurement logic.
- Lock them once the boot flow completes.
- Use a secure one-way hash for the measurement, as the description specifies.
Quick check
What does an attacker spoof here?
The final boot measurement, so a remote party believes unmodified code ran.
