1982
JTAG is useful to chip and device manufacturers during design, testing, and production and is
included in nearly every product. Without proper authentication and authorization, the interface may
allow tampering with a product.
Example Language: Other (Good)
In order to prevent exposing the debugging interface, manufacturers might try to obfuscate the JTAG interface or blow
device internal fuses to disable the JTAG interface. Adding authentication and authorization to this interface makes use by
unauthorized individuals much more difficult.
Example 2:
The following example code is a snippet from the JTAG wrapper module in the RISC-V debug
module of the HACK@DAC'21 Openpiton SoC [REF-1355]. To make sure that the JTAG is
accessed securely, the developers have included a primary authentication mechanism based on a
password.
The developers employed a Finite State Machine (FSM) to implement this authentication. When a
user intends to read from or write to the JTAG module, they must input a password.
In the subsequent state of the FSM module, the entered password undergoes Hash-based
Message Authentication Code (HMAC) calculation using an internal HMAC submodule. Once the
HMAC for the entered password is computed by the HMAC submodule, the FSM transitions to the
next state, where it compares the computed HMAC with the expected HMAC for the password.
If the computed HMAC matches the expected HMAC, the FSM grants the user permission to
perform read or write operations on the JTAG module. [REF-1352]
Example Language: Verilog (Bad)
...
PassChkValid: begin
if(hashValid) begin
if(exp_hash == pass_hash) begin
pass_check = 1'b1;
end else begin
pass_check = 1'b0;
end
state_d = Idle;
end else begin
state_d = PassChkValid;
end
end
...
However, in the given vulnerable part of the code, the JTAG module has not defined a limitation
for several continuous wrong password attempts. This omission poses a significant security risk,
allowing attackers to carry out brute-force attacks without restrictions.
Without a limitation on wrong password attempts, an attacker can repeatedly guess different
passwords until they gain unauthorized access to the JTAG module. This leads to various
malicious activities, such as unauthorized read from or write to debug module interface.
To mitigate the mentioned vulnerability, developers need to implement a restriction on the number
of consecutive incorrect password attempts allowed by the JTAG module, which can achieve
by incorporating a mechanism that temporarily locks the module after a certain number of failed
attempts.[REF-1353][REF-1354]
Example Language: Verilog (Good)
...
case (state_q)
Idle: begin
...
CWE Version 4.14
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control