2208
Nature Type ID Name Page
MemberOf 557 Concurrency Issues 2329
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (CPU)
An unexpected call to blocking code can trigger an infinite
loop, or a large loop that causes the software to pause and
wait indefinitely.
Potential Mitigations
Phase: Implementation
Generally speaking, blocking calls should be replaced with non-blocking alternatives that can be
used asynchronously. Expensive computations should be passed off to worker threads, although
the correct approach depends on the framework being used.
Phase: Implementation
For expensive computations, consider breaking them up into multiple smaller computations.
Refer to the documentation of the framework being used for guidance.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Related Attack Patterns
CAPEC-ID Attack Pattern Name
25 Forced Deadlock
CWE-1323: Improper Management of Sensitive Trace Data
Weakness ID : 1323
Structure : Simple
Abstraction : Base
Description
Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected
locations or transported to untrusted agents.
Extended Description
To facilitate verification of complex System-on-Chip (SoC) designs, SoC integrators add specific
IP blocks that trace the SoC's internal signals in real-time. This infrastructure enables observability
of the SoC's internal behavior, validation of its functional design, and detection of hardware and
software bugs. Such tracing IP blocks collect traces from several sources on the SoC including
the CPU, crypto coprocessors, and on-chip fabrics. Traces collected from these sources are then
aggregated inside trace IP block and forwarded to trace sinks, such as debug-trace ports that
facilitate debugging by external hardware and software debuggers.
Since these traces are collected from several security-sensitive sources, they must be protected
against untrusted debuggers. If they are stored in unprotected memory, an untrusted software
CWE Version 4.14
CWE-1323: Improper Management of Sensitive Trace Data
CWE-1323: Improper Management of Sensitive Trace Data