CWE-1209
Weakness AllowedFailure to Disable Reserved Bits
Abstraction: Base · Status: Incomplete
The reserved bits in a hardware design are not disabled prior to production.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
The Designer and Implementer have to make a conscious choice to do this. Designers might covertly use reserved bits to debug or further develop new capabilities in production hardware. Designers might want to use these bits to debug or control/configure a future capability to help minimize time to market (TTM).
If documentation labels anything "for future use", "reserved", or the like, such labeling could indicate to an attacker a potential attack point.
Content history
updated Related_Attack_Patterns
updated Potential_Mitigations
updated Demonstrative_Examples
updated Demonstrative_Examples
updated Relationships
updated Mapping_Notes
updated Weakness_Ordinalities
updated Background_Details, Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
0 vulnerabilities reference this CWE, most recent first.
No vulnerabilities reference this CWE.
Mitigation
Include a feature to disable reserved bits.
Mitigation
Any writes to these reserve bits are blocked (e.g., ignored, access-protected, etc.), or an exception can be asserted.
CAPEC-121: Exploit Non-Production Interfaces
An adversary exploits a sample, demonstration, test, or debug interface that is unintentionally enabled on a production system, with the goal of gleaning information or leveraging functionality that would otherwise be unavailable.