CWE-1231: Improper Prevention of Lock Bit Modification

BaseStable

The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the value of the lock bit from being modified after it has been set.

View on MITRE
Back to CWE Lookup

Extended Description

In integrated circuits and hardware intellectual property (IP) cores, device configuration controls are commonly programmed after a device power reset by a trusted firmware or software module (e.g., BIOS/bootloader) and then locked from any further modification. This behavior is commonly implemented using a trusted lock bit. When set, the lock bit disables writes to a protected set of registers or address regions. Design or coding errors in the implementation of the lock bit protection feature may allow the lock bit to be modified or cleared by software after it has been set. Attackers might be able to unlock the system and features that the bit is intended to protect.

Technical Details

Structure
Simple
Vulnerability Mapping
ALLOWED

Applicable To

Languages
Not Language-Specific
Platforms
Not OS-Specific

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-1231 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-1231, Improper Prevention of Lock Bit Modification, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development FrameworkNational Institute of Standards and Technology

Address Improper Prevention of Lock Bit Modification during Architecture and Design

MITRE associates mitigation with Architecture and Design, Implementation, and Testing; documented detection approaches include Manual Analysis; recorded impacts include Modify Memory. Use these source-defined anchors to turn CWE-1231 into implementation, review, and verification checks for the affected component.

CWE-1231: Improper Prevention of Lock Bit ModificationMITRE CWE

Triage CWE-1231 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-1231, Improper Prevention of Lock Bit Modification, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-1231

Apply MITRE's full root-cause mapping guidance when using CWE-1231, Improper Prevention of Lock Bit Modification. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping GuidanceMITRE CWE

Validate CWE-1231 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-1231, Improper Prevention of Lock Bit Modification. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick TipsMITRE CWE

Frequently Asked Questions

What is CWE-1231: Improper Prevention of Lock Bit Modification?+

CWE-1231: Improper Prevention of Lock Bit Modification is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the value of the lock bit from being modified after it has been set. In integrated circuits and hardware intellectual property (IP) cores, device configuration controls are commonly programmed after a device power reset by a trusted firmware or software module (e.g., BIOS/bootloader) and then locked from any further modification. This behavior is commonly implemented using a trusted lock bit. When set, the lock bit disables writes to a protected set of registers or address regions. Design or coding errors in the implementation of the lock bit protection feature may allow the lock bit to be modified or cleared by software after it has been set. Attackers might be able to unlock the system and features that the bit is intended to protect.

What are the security consequences of Improper Prevention of Lock Bit Modification?+

If exploited, CWE-1231 (Improper Prevention of Lock Bit Modification) it can compromise Access Control, leading to outcomes such as Modify Memory.

How do you prevent or mitigate Improper Prevention of Lock Bit Modification?+

Recommended mitigations for CWE-1231 include: Security lock bit protections must be reviewed for design inconsistency and common weaknesses. Security lock programming flow and lock properties must be tested in pre-silicon and post-silicon testing.

How is Improper Prevention of Lock Bit Modification detected?+

CWE-1231 can be detected using Manual Analysis. Combining automated tooling with manual review typically yields the best coverage.

Which programming languages are affected by Improper Prevention of Lock Bit Modification?+

CWE-1231 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Improper Prevention of Lock Bit Modification?+

MITRE documents real CVEs mapped to CWE-1231, including CVE-2017-6283. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-1231 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More

Advertisement