CWE-1232 – Improper Lock Behavior After Power State Transition
Description Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected registers or lock bits become programmable...
CWE-1231 – Improper Prevention of Lock Bit Modification
Description The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the...
CWE-1230 – Exposure of Sensitive Information Through Metadata
Description The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from...
CWE-123 – Write-what-where Condition
Description Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer...
CWE-1229 – Creation of Emergent Resource
Description The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation...
CWE-1224 – Improper Restriction of Write-Once Bit Fields
Description The hardware design control register "sticky bits" or write-once bit fields are improperly implemented, such that they can be reprogrammed by software. Modes of...
CWE-1223 – Race Condition for Write-Once Attributes
Description A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted software component, resulting in a race condition...
CWE-1222 – Insufficient Granularity of Address Regions Protected by Register Locks
Description The product defines a large address region protected from modification by the same register lock control bit. This results in a conflict between the...
CWE-1221 – Incorrect Register Defaults or Module Parameters
Description Hardware description language code incorrectly defines register defaults or hardware IP parameters to insecure values. Modes of Introduction: - Implementation Related Weaknesses...
CWE-1220 – Insufficient Granularity of Access Control
Description The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets...
