MITRE, which publishes a list of top software vulnerabilities in conjunction with US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA), has now published a list of the most important hardware weaknesses, too.

MITRE publishes the the Common Weakness Enumeration (CWE) for software flaws, but this year has run a survey to create its first ever equivalent list for hardware flaws. 

Security

• 8 habits of highly secure remote workers
• How to find and remove spyware from your phone
• The best VPN services: How do the top 5 compare?
• How to find out if you are involved in a data breach -- and what to do next

The 2021 Hardware List aims to boost awareness of common hardware flaws and to prevent hardware security issues by educating designers and programmers on how to eliminate important mistakes early in the product development lifecycle.

SEE: Gartner releases its 2021 emerging tech hype cycle: Here's what's in and headed out

"Security analysts and test engineers can use the list in preparing plans for security testing and evaluation. Hardware consumers could use the list to help them to ask for more secure hardware products from their suppliers. Finally, managers and CIOs can use the list as a measuring stick of progress in their efforts to secure their hardware and ascertain where to direct resources to develop security tools or automation processes that mitigate a wide class of vulnerabilities by eliminating the underling root cause," MITRE said. 

The list was determined by a survey of the CWE Team and members of the hardware special interest group.

The list, which isn't in any particular order, includes bugs that affect a range of devices including smartphones, Wi-Fi routers, PC chips, and cryptographic protocols for protecting secrets in hardware, flaws in protected memory areas, Rowhammer-style bit-flipping bugs, and firmware update failures. 

The hardware weaknesses list is meant to serve as "authoritative guidance for mitigating and avoiding them" and is a companion to its annual 25 most dangerous software weaknesses list.

One submitted by Intel engineers, CWE-1231, regards "improper prevention of lock bit modification" that can be introduced during the design of integrated circuits. 

SEE: Cloud security in 2021: A business guide to essential tools and best practices

"In integrated circuits and hardware intellectual property (IP) cores, device configuration controls are commonly programmed after a device power reset by a trusted firmware or software module (e.g., BIOS/bootloader) and then locked from any further modification," MITRE notes. 

"This behavior is commonly implemented using a trusted lock bit. When set, the lock bit disables writes to a protected set of registers or address regions. Design or coding errors in the implementation of the lock bit protection feature may allow the lock bit to be modified or cleared by software after it has been set. Attackers might be able to unlock the system and features that the bit is intended to protect." 

The entries also include past examples of the types of flaws, such as CVE-2017-6283, that affected the NVIDIA Security Engine. It contained a "vulnerability in the RSA function where the keyslot read/write lock permissions are cleared on a chip reset, which may lead to information disclosure."

CWE-1189	Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
CWE-1191	On-Chip Debug and Test Interface With Improper Access Control
CWE-1231	Improper Prevention of Lock Bit Modification
CWE-1233	Security-Sensitive Hardware Controls with Missing Lock Bit Protection
CWE-1240	Use of a Cryptographic Primitive with a Risky Implementation
CWE-1244	Internal Asset Exposed to Unsafe Debug Access Level or State
CWE-1256	Improper Restriction of Software Interfaces to Hardware Features
CWE-1260	Improper Handling of Overlap Between Protected Memory Ranges
CWE-1272	Sensitive Information Uncleared Before Debug/Power State Transition
CWE-1274	Improper Access Control for Volatile Memory Containing Boot Code
CWE-1277	Firmware Not Updateable
CWE-1300	Improper Protection of Physical Side Channels

Hardware

The best photography drones: Capture stunning aerial footageOur favorite robot mowers: Hands-free lawn careThe top 5 home batteries: Backup systems to keep you chargedThe best cheap vacuum cleaners: Affordable and reliable vacs

• The best photography drones: Capture stunning aerial footage
• Our favorite robot mowers: Hands-free lawn care
• The top 5 home batteries: Backup systems to keep you charged
• The best cheap vacuum cleaners: Affordable and reliable vacs