Description
Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values.
Integrated circuits and hardware IP software programmable controls and settings are commonly stored in register circuits. These register contents have to be initialized at hardware reset to defined default values that are hard coded in the hardware description language (HDL) code of the hardware unit. Hardware descriptive languages also support definition of parameter variables, which can be defined in code during instantiation of the hardware IP module. Such parameters are generally used to configure a specific instance of a hardware IP in the design. The system security settings of a hardware design can be affected by incorrectly defined default values or IP parameters. The hardware IP would be in an insecure state at power reset, and this can be exposed or exploited by untrusted software running on the system. Both register defaults and parameters are hardcoded values, which cannot be changed using software or firmware patches but must be changed in hardware silicon. Thus, such security issues are considerably more difficult to address later in the lifecycle. Hardware designs can have a large number of such parameters and register defaults settings, and it is important to have design tool support to check these settings in an automated way and be able to identify which settings are security sensitive.
Potential Impact
Confidentiality, Integrity, Availability, Access Control
Varies by Context
Demonstrative Examples
// Parameterized Register module example
// Secure_mode : REGISTER_DEFAULT[0] : When set to 1 register is read only and not writable//
module register_example
#(
parameter REGISTER_WIDTH = 8, // Parameter defines width of register, default 8 bits
parameter [REGISTER_WIDTH-1:0] REGISTER_DEFAULT = 2**REGISTER_WIDTH -2 // Default value of register computed from Width. Sets all bits to 1s except bit 0 (Secure _mode)
)
(
input [REGISTER_WIDTH-1:0] Data_in,
input Clk,
input resetn,
input write,
output reg [REGISTER_WIDTH-1:0] Data_out
);
reg Secure_mode;
always @(posedge Clk or negedge resetn)
if (~resetn)
begin
Data_out <= REGISTER_DEFAULT; // Register content set to Default at reset
Secure_mode <= REGISTER_DEFAULT[0]; // Register Secure_mode set at reset
end
else if (write & ~Secure_mode)
begin
Data_out <= Data_in;
end
endmodule
module register_top
(
input Clk,
input resetn,
input write,
input [31:0] Data_in,
output reg [31:0] Secure_reg,
output reg [31:0] Insecure_reg
);
register_example #(
.REGISTER_WIDTH (32),
.REGISTER_DEFAULT (1224) // Incorrect Default value used bit 0 is 0.
) Insecure_Device_ID_1 (
.Data_in (Data_in),
.Data_out (Secure_reg),
.Clk (Clk),
.resetn (resetn),
.write (write)
);
register_example #(
.REGISTER_WIDTH (32) // Default not defined 2^32-2 value will be used as default.
) Insecure_Device_ID_2 (
.Data_in (Data_in),
.Data_out (Insecure_reg),
.Clk (Clk),
.resetn (resetn),
.write (write)
);
endmoduleregister_example #(
.REGISTER_WIDTH (32),
.REGISTER_DEFAULT (1225) // Correct default value set, to enable Secure_mode
) Secure_Device_ID_example (
.Data_in (Data_in),
.Data_out (Secure_reg),
.Clk (Clk),
.resetn (resetn),
.write (write)
);parameter MEM_SIZE = 100;
localparam JTAG_OFFSET = 81;
const logic [MEM_SIZE-1:0][31:0] mem = {
// JTAG expected hamc hash
32'h49ac13af, 32'h1276f1b8, 32'h6703193a, 32'h65eb531b,
32'h3025ccca, 32'h3e8861f4, 32'h329edfe5, 32'h98f763b4,
...
assign jtag_hash_o = {mem[JTAG_OFFSET-1],mem[JTAG_OFFSET-2],mem[JTAG_OFFSET-3],
mem[JTAG_OFFSET-4],mem[JTAG_OFFSET-5],mem[JTAG_OFFSET-6],mem[JTAG_OFFSET-7],mem[JTAG_OFFSET-8]};
...parameter MEM_SIZE = 100;
localparam JTAG_OFFSET = 100;module acct_wrapper #(
...
always @(posedge clk_i)
begin
if(~(rst_ni && ~rst_6))
begin
for (j=0; j < AcCt_MEM_SIZE; j=j+1)
begin
acct_mem[j] <= 32'hffffffff;
end
end
...module acct_wrapper #(
...
always @(posedge clk_i)
begin
if(~(rst_ni && ~rst_6))
begin
for (j=0; j < AcCt_MEM_SIZE; j=j+1)
begin
acct_mem[j] <= 32'h00000000;
end
end
...Mitigations & Prevention
During hardware design, all the system parameters and register defaults must be reviewed to identify security sensitive settings.
The default values of these security sensitive settings need to be defined as part of the design review phase.
Detection Methods
- Automated Analysis — Use automated tools to test that values are configured per design specifications.
Related Weaknesses
Frequently Asked Questions
What is CWE-1221?
CWE-1221 (Incorrect Register Defaults or Module Parameters) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values.
How can CWE-1221 be exploited?
Attackers can exploit CWE-1221 (Incorrect Register Defaults or Module Parameters) to varies by context. This weakness is typically introduced during the Implementation phase of software development.
How do I prevent CWE-1221?
Key mitigations include: During hardware design, all the system parameters and register defaults must be reviewed to identify security sensitive settings.
What is the severity of CWE-1221?
CWE-1221 is classified as a Base-level weakness (Medium abstraction). Its actual severity depends on the specific context and how the weakness manifests in your application.