  To help prevent hardware security vulnerabilities from propagating to later
design stages where fixes are costly, it is crucial to identify security
concerns as early as possible, such as in RTL designs. In this work, we
investigate the practical implications and feasibility of producing a set of
security-specific scanners that operate on Verilog source files. The scanners
indicate parts of code that might contain one of a set of MITRE's common
weakness enumerations (CWEs). We explore the CWE database to characterize the
scope and attributes of the CWEs and identify those that are amenable to static
analysis. We prototype scanners and evaluate them on 11 open source designs - 4
system-on-chips (SoC) and 7 processor cores - and explore the nature of
identified weaknesses. Our analysis reported 53 potential weaknesses in the
OpenPiton SoC used in Hack@DAC-21, 11 of which we confirmed as security
concerns.
