2153
Phase: Implementation
Ensure that a debug message does not reveal any unnecessary information during the debug
process for the intended response.
Demonstrative Examples
Example 1:
This example here shows how an attacker can take advantage of unnecessary information in
debug messages.
Example 1: Suppose in response to a Test Access Port (TAP) chaining request the debug
message also reveals the current TAP hierarchy (the full topology) in addition to the success/failure
message.
Example 2: In response to a password-filling request, the debug message, instead of a simple
Granted/Denied response, prints an elaborate message, "The user-entered password does not
match the actual password stored in <directory name>."
The result of the above examples is that the user is able to gather additional unauthorized
information about the system from the debug messages.
The solution is to ensure that Debug messages do not reveal additional details.
Observed Examples
Reference Description
CVE-2021-25476 Digital Rights Management (DRM) capability for mobile platform leaks pointer
information, simplifying ASLR bypass
https://www.cve.org/CVERecord?id=CVE-2021-25476
CVE-2020-24491 Processor generates debug message that contains sensitive information
("addresses of memory transactions").
https://www.cve.org/CVERecord?id=CVE-2020-24491
CVE-2017-18326 modem debug messages include cryptographic keys
https://www.cve.org/CVERecord?id=CVE-2017-18326
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1207 Debug and Test Problems 1194 2474
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Related Attack Patterns
CAPEC-ID Attack Pattern Name
121 Exploit Non-Production Interfaces
References
[REF-1112]"Android Security Bulletin - December 2018". < https://source.android.com/security/
bulletin/2018-12-01.html >.2023-04-07.
CWE-1296: Incorrect Chaining or Granularity of Debug Components
Weakness ID : 1296
Structure : Simple
Abstraction : Base
CWE Version 4.14
CWE-1296: Incorrect Chaining or Granularity of Debug Components
CWE-1296: Incorrect Chaining or Granularity of Debug Components