COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1242

Inclusion of Undocumented Features or Chicken Bits

The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.

Extended description

A common design practice is to use undocumented bits on a device that can be used to disable certain functional security features. These bits are commonly referred to as "chicken bits". They can facilitate quick identification and isolation of faulty components, features that negatively affect performance, or features that do not provide the required controllability for debug and test. Another way to achieve this is through implementation of undocumented features.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

Lifecycle phase

Implementation

Lifecycle phase

Documentation

Risk

What does successful exploitation lead to?

Modify MemoryRead MemoryExecute Unauthorized Code or CommandsGain Privileges or Assume IdentityBypass Protection Mechanism

Affected security scopes: Confidentiality, Integrity, Availability, Access Control

An attacker might exploit these interfaces for unauthorized access.

Defence

How is it prevented and fixed?

Architecture and Design · Implementation

Defence to apply across several lifecycle phases

Detail
The implementation of chicken bits in a released product is highly discouraged. If implemented at all, ensure that they are disabled in production devices. All interfaces to a device should be documented.

Effectiveness: High

CWE-1242: Common Weakness Enumeration Entry CWE-1242 · DayBreach Sözlük · DayBreach