Race Condition for Write-Once Attributes

A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted software component, resulting in a race condition issue.

Implementation issues in hardware design of such controls can expose such registers to a race condition security flaw. For example, consider a hardware design that has two different software/firmware modules executing in parallel. One module is trusted (module A) and another is untrusted (module B). In this design, it could be possible for Module B to send write cycles to the write-once register before Module A. Since the field is write-once, the programmed value from Module A will be ignored and the pre-empted value programmed by Module B will be used by hardware.

We track 1 vulnerability of this type. 100% are rated high or critical, and the average CVSS score is 8.8.

How this weakness is prevented

• Architecture and Design: During hardware design, all register write-once or sticky fields must be evaluated for proper configuration.