  Hardware security is an important concern of system security as
vulnerabilities can arise from design errors introduced throughout the
development lifecycle. Recent works have proposed techniques to detect hardware
security bugs, such as static analysis, fuzzing, and symbolic execution.
However, the fundamental properties of hardware security bugs remain relatively
unexplored. To gain a better understanding of hardware security bugs, we
perform a deep dive into the popular OpenTitan project, including its bug
reports and bug fixes. We manually classify the bugs as relevant to
functionality or security and analyze characteristics, such as the impact and
location of security bugs, and the size of their bug fixes. We also investigate
relationships between security impact and bug management during development.
Finally, we propose an abstract syntax tree-based analysis to identify the
syntactic characteristics of bug fixes. Our results show that 53% of the bugs
in OpenTitan have potential security implications and that 55% of all bug fixes
modify only one file. Our findings underscore the importance of security-aware
development practices and tools and motivate the development of techniques that
leverage the highly localized nature of hardware bugs.
