CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection

The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents modification of system registers or controls that perform changes to important hardware system configuration.

• Access Control: Modify Memory — System Configuration protected by the lock bit can be modified even when the lock is set. If the lock bit does not effectively write-protect all system registers or controls that could modify the protected system configuration, then an adversary may be able to use software to access the registers/controls and modify the protected hardware configuration.

• [Architecture and Design, Implementation, Testing] • Security lock bit protections must be reviewed for design inconsistency and common weaknesses. • Security lock programming flow and lock properties must be tested in pre-silicon and post-silicon testing.

• Manual Analysis: Set the lock bit. Attempt to modify the information protected by the lock bit. If the information is changed, implement a design fix. Retest. Also, attempt to indirectly clear the lock bit or bypass it.

• CVE-2025-61972: Processor product does not perform lock bit protection for certain registers. • CVE-2018-9085: Certain servers leave a write protection lock bit unset after boot, potentially allowing modification of parts of flash memory. • CVE-2014-8273: Chain: chipset has a race condition (CWE-362) between when an interrupt handler detects an attempt to write-enable the BIOS (in violation of the lock bit), and when the handler resets the write-enable bit back to 0, allowing attackers to issue BIOS writes during the timing window [REF-1237].