2186
Structure : Simple
Abstraction : Base
Description
During runtime, the hardware allows for test or debug logic (feature) to be activated, which allows
for changing the state of the hardware. This feature can alter the intended behavior of the system
and allow for alteration and leakage of sensitive data by an adversary.
Extended Description
An adversary can take advantage of test or debug logic that is made accessible through the
hardware during normal operation to modify the intended behavior of the system. For example,
an accessible Test/debug mode may allow read/write access to any system data. Using error
injection (a common test/debug feature) during a transmit/receive operation on a bus, data may be
modified to produce an unintended message. Similarly, confidentiality could be compromised by
such features allowing access to secrets.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Modify Memory
Read Memory
DoS: Crash, Exit, or Restart
DoS: Instability
DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
DoS: Resource Consumption (Other)
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Alter Execution Logic
Quality Degradation
Unexpected State
Reduce Performance
Reduce Reliability
Potential Mitigations
Phase: Architecture and Design
CWE Version 4.14
CWE-1314: Missing Write Protection for Parametric Data Values
CWE-1314: Missing Write Protection for Parametric Data Values