CWE-1221 Incorrect Register Defaults or Module Parameters

Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values.

• Confidentiality, Integrity, Availability, Access Control: Varies by Context — The system security settings of a hardware design can be affected by incorrectly defined default values or IP parameters. The hardware IP would be in an insecure state at power reset, and this can be exposed or exploited by untrusted software running on the system. Degradation of system functionality or loss of access control enforcement can occur. • Other: Reduce Maintainability — Both register defaults and parameters are hardcoded values, which cannot be changed using software or firmware patches but must be changed in hardware silicon. Thus, such security issues are considerably more difficult to address later in the lifecycle.

• [Architecture and Design] During hardware design, all the system parameters and register defaults must be reviewed to identify security sensitive settings. • [Implementation] The default values of these security sensitive settings need to be defined as part of the design review phase.

• Automated Analysis: Use automated tools to test that values are configured per design specifications. Hardware designs can have a large number of such parameters and register defaults settings, and it is important to have design tool support to check these settings in an automated way and be able to identify which settings are security sensitive.