1984
Write: begin
...
if (pass_mode) begin
pass_data = data_d;
state_d = PassChk;
pass_mode = 1'b0;
...
end
...
Observed Examples
Reference Description
CVE-2019-18827 chain: JTAG interface is not disabled (CWE-1191) during ROM code
execution, introducing a race condition (CWE-362) to extract encryption keys
https://www.cve.org/CVERecord?id=CVE-2019-18827
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1207 Debug and Test Problems 1194 2474
MemberOf 1343 Weaknesses in the 2021 CWE Most Important
Hardware Weaknesses List
1343 2592
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Relationship
CWE-1191 and CWE-1244 both involve physical debug access, but the weaknesses are
different. CWE-1191 is effectively about missing authorization for a debug interface, i.e. JTAG.
CWE-1244 is about providing internal assets with the wrong debug access level, exposing the
asset to untrusted debug agents.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
1 Accessing Functionality Not Properly Constrained by ACLs
180 Exploiting Incorrectly Configured Access Control Security Levels
References
[REF-1037]Kurt Rosenfeld and Ramesh Karri. "Attacks and Defenses for JTAG". 2010 February. <
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5406671 >.
[REF-1043]Gopal Vishwakarma and Wonjun Lee. "Exploiting JTAG and Its Mitigation in IOT: A
Survey". 2018 December 3. < https://www.mdpi.com/1999-5903/10/12/121/pdf >.2023-04-07.
[REF-1084]Gopal Vishwakarma and Wonjun Lee. "JTAG Explained (finally!): Why
"IoT", Software Security Engineers, and Manufacturers Should Care". < https://
www.mdpi.com/1999-5903/10/12/121/pdf >.2023-04-07.
[REF-1085]Bob Molyneaux, Mark McDermott and Anil Sabbavarapu. "Design for Testability &
Design for Debug". < http://users.ece.utexas.edu/~mcdermot/vlsi-2/Lecture_17.pdf >.
[REF-1355]Florian Zaruba. "dmi_jtag.sv". 2021. < https://github.com/HACK-EVENT/hackatdac21/
blob/71103971e8204de6a61afc17d3653292517d32bf/piton/design/chip/tile/ariane/src/riscv-dbg/
src/dmi_jtag.sv#L192:L204 >.2023-09-18.
CWE Version 4.14
CWE-1192: Improper Identifier for IP Block used in System-On-Chip (SOC)
CWE-1192: Improper Identifier for IP Block used in System-On-Chip (SOC)