562
ParentOf 1330 Remanent Data Readable after Memory Erase 2222
Relevant to the view "Hardware Design" (CWE-1194)
Nature Type ID Name Page
ParentOf 1330 Remanent Data Readable after Memory Erase 2222
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
Read Application Data
Potential Mitigations
Phase: Architecture and Design
Apply blinding or masking techniques to implementations of cryptographic algorithms.
Phase: Implementation
Alter the method of erasure, add protection of media, or destroy the media to protect the data.
Observed Examples
Reference Description
CVE-2019-8575 Firmware Data Deletion Vulnerability in which a base station factory reset
might not delete all user information. The impact of this enables a new owner
of a used device that has been "factory-default reset" with a vulnerable
CWE Version 4.14
CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
CWE-1302: Missing Source Identifier in Entity
Transactions on a System-On-Chip (SOC) 2172
Reference Description
firmware version can still retrieve, at least, the previous owner's wireless
network name, and the previous owner's wireless security (such as WPA2)
key. This issue was addressed with improved, data deletion.
https://www.cve.org/CVERecord?id=CVE-2019-8575
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1208 Cross-Cutting Problems 1194 2474
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Maintenance
This entry is still under development and will continue to see updates and content improvements.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
37 Retrieve Embedded Sensitive Data
References
[REF-1117]Paul Kocher, Joshua Jaffe and Benjamin Jun. "Introduction to differential power
analysis and related attacks". 1998. < https://www.rambus.com/wp-content/uploads/2015/08/
DPATechInfo.pdf >.
[REF-1118]Dakshi Agrawal, Bruce Archambeault, Josyula R. Rao and Pankaj Rohatgi.
"The EM Side-Channel(s)". 2007 August 4. < https://link.springer.com/content/
pdf/10.1007/3-540-36400-5_4.pdf >.2023-04-07.
[REF-1119]Daniel Genkin, Adi Shamir and Eran Tromer. "RSA key extraction via
low-bandwidth acoustic cryptanalysis". 2014 June 3. < https://www.iacr.org/archive/
crypto2014/86160149/86160149.pdf >.
[REF-1120]Colin O'Flynn. "Power Analysis for Cheapskates". 2013 January 4. < https://
media.blackhat.com/eu-13/briefings/OFlynn/bh-eu-13-for-cheapstakes-oflynn-wp.pdf >.
[REF-1055]Peter Gutmann. "Data Remanence in Semiconductor Devices". 10th USENIX Security
Symposium. 2001 August. < https://www.usenix.org/legacy/events/sec01/full_papers/gutmann/
gutmann.pdf >.
CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-
Chip (SOC)
Weakness ID : 1302
Structure : Simple
Abstraction : Base
Description
The product implements a security identifier mechanism to differentiate what actions are allowed
or disallowed when a transaction originates from an entity. A transaction is sent without a security
identifier.
Extended Description
CWE Version 4.14
CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
CWE-1302: Missing Source Identifier in Entity
Transactions on a System-On-Chip (SOC)