565
After the transition to state B, even though the private keys are no longer accessible directly from
the fuses in state B, they can be accessed indirectly by reading the memory that contains the
private keys.
Example Language: (Good)
For transition from state A to state B, remove information which should not be available once the transition is complete.
Example 2:
The following code calls realloc() on a buffer containing sensitive data:
Example Language: C (Bad)
cleartext_buffer = get_secret();...
cleartext_buffer = realloc(cleartext_buffer, 1024);
...
scrub_memory(cleartext_buffer, 1024);
There is an attempt to scrub the sensitive data from memory, but realloc() is used, so it could
return a pointer to a different part of memory. The memory that was originally allocated for
cleartext_buffer could still contain an uncleared copy of the data.
Example 3:
The following example code is excerpted from the AES wrapper/interface, aes0_wrapper, module
of one of the AES engines (AES0) in the Hack@DAC'21 buggy OpenPiton System-on-Chip (SoC).
Note that this SoC contains three distinct AES engines. Within this wrapper module, four 32-bit
registers are utilized to store the message intended for encryption, referred to as p_c[i]. Using the
AXI Lite interface, these registers are filled with the 128-bit message to be encrypted.
Example Language: Verilog (Bad)
module aes0_wrapper #(...)(...);
...
always @(posedge clk_i)
begin
if(~(rst_ni && ~rst_1)) //clear p_c[i] at reset
begin
start <= 0;
p_c[0] <= 0;
p_c[1] <= 0;
p_c[2] <= 0;
p_c[3] <= 0;
...
end
else if(en && we)
case(address[8:3])
0:
start <= reglk_ctrl_i[1] ? start : wdata[0];
1:
p_c[3] <= reglk_ctrl_i[3] ? p_c[3] : wdata[31:0];
2:
p_c[2] <= reglk_ctrl_i[3] ? p_c[2] : wdata[31:0];
3:
p_c[1] <= reglk_ctrl_i[3] ? p_c[1] : wdata[31:0];
4:
p_c[0] <= reglk_ctrl_i[3] ? p_c[0] : wdata[31:0];
...
endcase
end // always @ (posedge wb_clk_i)
endmodule
CWE Version 4.14
CWE-226: Sensitive Information in Resource Not Removed Before Reuse
CWE-226: Sensitive Information in Resource Not Removed Before Reuse