COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1243

Sensitive Non-Volatile Information Not Protected During Debug

Access to security-sensitive information stored in fuses is not limited during debug.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

Access to security-sensitive information stored in fuses is not limited during debug.

Genişletilmiş açıklama

Several security-sensitive values are programmed into fuses to be used during early-boot flows or later at runtime. Examples of these security-sensitive values include root keys, encryption keys, manufacturing-specific information, chip-manufacturer-specific information, and original-equipment-manufacturer (OEM) data. After the chip is powered on, these values are sensed from fuses and stored in temporary locations such as registers and local memories. These locations are typically access-control protected from untrusted agents capable of accessing them. Even to trusted agents, only read-access is provided.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Modify MemoryRead MemoryBypass Protection Mechanism

Etkilenen güvenlik alanları: Confidentiality, Access Control

If these locations are not blocked during debug operations, it can allow a user to access this sensitive information.

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design · Implementation

Birden fazla yaşam döngüsü evresinde uygulanacak savunma

Detay
Disable access to security-sensitive information stored in fuses directly and also reflected from temporary storage locations when in debug mode.