COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1271

Uninitialized Value on Reset for Registers Holding Security Settings

Security-critical logic is not set to a known value on reset.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

Security-critical logic is not set to a known value on reset.

Extended description

When the device is first brought out of reset, the state of registers will be indeterminate if they have not been initialized by the logic. Before the registers are initialized, there will be a window during which the device is in an insecure state and may be vulnerable to attack.

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

Risk

What does successful exploitation lead to?

Varies by Context

Affected security scopes: Access Control, Authentication, Authorization

Defence

How is it prevented and fixed?

Implementation

Implementation-phase defence

Detail
Design checks should be performed to identify any uninitialized flip-flops used for security-critical functions.

Architecture and Design

Architecture and design approach

Detail
All registers holding security-critical information should be set to a specific value on reset.