Tag Archives: Security-Sensitive Hardware Controls with Missing Lock Bit Protection

CWE-1233 – Security-Sensitive Hardware Controls with Missing Lock Bit Protection

Read Time:47 Second

Description

The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents modification of system registers or controls that perform changes to important hardware system configuration.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-284
CWE-667

 

Consequences

Access Control: Modify Memory

System Configuration protected by the lock bit can be modified even when the lock is set.

 

Potential Mitigations

Phase: Architecture and Design, Implementation, Testing

Description: 

CVE References

  • CVE-2018-9085
    • Certain servers leave a write protection lock bit
      unset after boot, potentially allowing modification of
      parts of flash memory.
  • CVE-2014-8273
    • Chain: chipset has a race condition (CWE-362) between when an interrupt handler detects an attempt to write-enable the BIOS (in violation of the lock bit), and when the handler resets the write-enable bit back to 0, allowing attackers to issue BIOS writes during the timing window [REF-1237].