Set the lock bit. Power cycle the device. Attempt to clear the lock bit. If the information is changed, implement a design fix. Retest. Also, attempt to indirectly clear the lock bit or bypass it.
CWE-1231 Base Estable
Improper Prevention of Lock Bit Modification
This vulnerability occurs when hardware or firmware uses a lock bit to protect critical system registers or memory regions, but fails to properly prevent that lock bit from being changed after it…
Definición
What is CWE-1231?
This vulnerability occurs when hardware or firmware uses a lock bit to protect critical system registers or memory regions, but fails to properly prevent that lock bit from being changed after it has been enabled. This design flaw allows attackers to bypass hardware-enforced security restrictions.
In hardware design and system-on-chip (SoC) architectures, a lock bit acts as a hardware-enforced security switch. Trusted firmware like a BIOS or bootloader typically sets this bit during initialization to permanently disable writes to protected configuration registers—such as those controlling debug modes, memory protection, or secure boot settings. Once locked, these settings should become immutable to prevent runtime tampering.
If the implementation contains flaws—like allowing the lock bit itself to be written, clearing it via a side channel, or failing to verify its state—attackers can reverse the lock. This effectively unlocks the protected resources, enabling unauthorized reconfiguration, privilege escalation, or extraction of sensitive data that the hardware was designed to guard.
Impacto en el mundo real
Real-world CVEs caused by CWE-1231
-
chip reset clears critical read/write lock permissions for RSA function
Cómo lo explotan los atacantes
Ruta del atacante paso a paso
- 1
Consider the example design below for a digital thermal sensor that detects overheating of the silicon and triggers system shutdown. The system critical temperature limit (CRITICAL_TEMP_LIMIT) and thermal sensor calibration (TEMP_SENSOR_CALIB) data have to be programmed by firmware, and then the register needs to be locked (TEMP_SENSOR_LOCK).
- 2
In this example, note that if the system heats to critical temperature, the response of the system is controlled by the TEMP_HW_SHUTDOWN bit [1], which is not lockable. Thus, the intended security property of the critical temperature sensor cannot be fully protected, since software can misconfigure the TEMP_HW_SHUTDOWN register even after the lock bit is set to disable the shutdown response.
- 3
The following example code is a snippet from the register locks inside the buggy OpenPiton SoC of HACK@DAC'21 [REF-1350]. Register locks help prevent SoC peripherals' registers from malicious use of resources. The registers that can potentially leak secret data are locked by register locks.
- 4
In the vulnerable code, the reglk_mem is used for locking information. If one of its bits toggle to 1, the corresponding peripheral's registers will be locked. In the context of the HACK@DAC System-on-Chip (SoC), it is pertinent to note the existence of two distinct categories of reset signals.
- 5
First, there is a global reset signal denoted as "rst_ni," which possesses the capability to simultaneously reset all peripherals to their respective initial states.
Ejemplo de código vulnerable
Vulnerable Other
Consider the example design below for a digital thermal sensor that detects overheating of the silicon and triggers system shutdown. The system critical temperature limit (CRITICAL_TEMP_LIMIT) and thermal sensor calibration (TEMP_SENSOR_CALIB) data have to be programmed by firmware, and then the register needs to be locked (TEMP_SENSOR_LOCK).
| Register | Field description |
| --- | --- |
| CRITICAL_TEMP_LIMIT | [31:8] Reserved field; Read only; Default 0 [7:0] Critical temp 0-255 Centigrade; Read-write-lock; Default 125 |
| TEMP_SENSOR_CALIB | [31:0] Thermal sensor calibration data. Slope value used to map sensor reading to degrees Centigrade. |
| TEMP_SENSOR_LOCK | [31:1] Reserved field; Read only; Default 0 [0] Lock bit, locks CRITICAL_TEMP_LIMIT and TEMP_SENSOR_CALIB registers; Write-1-once; Default 0 |
| TEMP_HW_SHUTDOWN | [31:2] Reserved field; Read only; Default 0 [1] Enable hardware shutdown on critical temperature detection; Read-write; Default 0 |
| CURRENT_TEMP | [31:8] Reserved field; Read only; Default 0 [7:0] Current Temp 0-255 Centigrade; Read-only; Default 0 | Ejemplo de código seguro
Secure Other
In this example, note that if the system heats to critical temperature, the response of the system is controlled by the TEMP_HW_SHUTDOWN bit [1], which is not lockable. Thus, the intended security property of the critical temperature sensor cannot be fully protected, since software can misconfigure the TEMP_HW_SHUTDOWN register even after the lock bit is set to disable the shutdown response.
To fix this weakness, one could change the TEMP_HW_SHUTDOWN field to be locked by TEMP_SENSOR_LOCK.
| |
|
| TEMP_HW_SHUTDOWN | [31:2] Reserved field; Read only; Default 0 [1] Enable hardware shutdown on critical temperature detection; Read-write-Lock; Default 0 [0] Locked by TEMP_SENSOR_LOCK | What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención
How to prevent CWE-1231
- Architecture and Design / Implementation / Testing - Security lock bit protections must be reviewed for design inconsistency and common weaknesses. - Security lock programming flow and lock properties must be tested in pre-silicon and post-silicon testing.
Señales de detección
How to detect CWE-1231
Plexicus detecta automáticamente CWE-1231 y abre un PR de corrección en menos de 60 segundos.
Codex Remedium escanea cada commit, identifica esta debilidad concreta y entrega un pull request listo para revisión con el parche. Sin tickets. Sin traspasos.
Preguntas frecuentes ¿Qué es CWE-1231?
¿Qué gravedad tiene CWE-1231?
¿Qué lenguajes o plataformas se ven afectados por CWE-1231?
¿Cómo puedo prevenir CWE-1231?
¿Cómo detecta y corrige Plexicus CWE-1231?
¿Dónde puedo aprender más sobre CWE-1231?
Frequently asked questions
¿Qué es CWE-1231?
This vulnerability occurs when hardware or firmware uses a lock bit to protect critical system registers or memory regions, but fails to properly prevent that lock bit from being changed after it has been enabled. This design flaw allows attackers to bypass hardware-enforced security restrictions.
¿Qué gravedad tiene CWE-1231?
MITRE no ha publicado una calificación de probabilidad de explotación para esta debilidad. Trátala como de impacto medio hasta que tu modelo de amenazas demuestre lo contrario.
¿Qué lenguajes o plataformas se ven afectados por CWE-1231?
MITRE lists the following affected platforms: Not OS-Specific, Not Architecture-Specific, Not Technology-Specific.
¿Cómo puedo prevenir CWE-1231?
- Security lock bit protections must be reviewed for design inconsistency and common weaknesses. - Security lock programming flow and lock properties must be tested in pre-silicon and post-silicon testing.
¿Cómo detecta y corrige Plexicus CWE-1231?
El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-1231 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.
¿Dónde puedo aprender más sobre CWE-1231?
MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/1231.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.
Debilidades relacionadas
Weaknesses related to CWE-1231
CWE-284 Padre
Improper Access Control
The software fails to properly limit who can access a resource, allowing unauthorized users or systems to interact with it.
CWE-1191 Hermano
On-Chip Debug and Test Interface With Improper Access Control
This vulnerability occurs when a hardware chip's debug or test interface (like JTAG) lacks proper access controls. Without correct…
CWE-1220 Hermano
Insufficient Granularity of Access Control
This vulnerability occurs when a system's access controls are too broad, allowing unauthorized users or processes to read or modify…
CWE-1224 Hermano
Improper Restriction of Write-Once Bit Fields
This vulnerability occurs when hardware write-once protection mechanisms, often called 'sticky bits,' are incorrectly implemented,…
CWE-1233 Hermano
Security-Sensitive Hardware Controls with Missing Lock Bit Protection
This vulnerability occurs when a hardware device uses a lock bit to protect critical configuration registers, but the lock fails to…
CWE-1252 Hermano
CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
This vulnerability occurs when a CPU's hardware is not set up to enforce a strict separation between writing data to memory and executing…
CWE-1257 Hermano
Improper Access Control Applied to Mirrored or Aliased Memory Regions
This vulnerability occurs when a hardware design maps the same physical memory to multiple addresses (aliasing or mirroring) but fails to…
CWE-1259 Hermano
Improper Restriction of Security Token Assignment
This vulnerability occurs when a System-on-a-Chip (SoC) fails to properly secure its Security Token mechanism. These tokens control which…
CWE-1260 Hermano
Improper Handling of Overlap Between Protected Memory Ranges
This vulnerability occurs when a system incorrectly allows different memory protection ranges to overlap. This flaw can let attackers…
Recursos
Further reading
- MITRE — CWE-1231 oficial https://cwe.mitre.org/data/definitions/1231.html
- reglk_wrapper.sv https://github.com/HACK-EVENT/hackatdac21/blob/b9ecdf6068445d76d6bee692d163fededf7a9d9b/piton/design/chip/tile/ariane/src/reglk/reglk_wrapper.sv#L80C1-L80C48
- fix cwe 1199 in reglk https://github.com/HACK-EVENT/hackatdac21/commit/5928add42895b57341ae8fc1f9b8351c35aed865#diff-1c2b09dd092a56e5fb2be431a3849e72ff489d2ae4f4a6bb9c0ea6b7d450135aR80
Listo cuando tú lo estés
Deja de pagar por desarrollador.
Empieza a cerrar el bucle.
Plexicus es el ASPM nativo de IA que escanea, filtra, corrige, pentestea y explica — de forma autónoma. Desarrolladores ilimitados, repos ilimitados, acciones de IA de uso justo. Nivel gratuito real, €269/mo anual cuando estés listo.