2035
CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug
Weakness ID : 1243
Structure : Simple
Abstraction : Base
Description
Access to security-sensitive information stored in fuses is not limited during debug.
Extended Description
Several security-sensitive values are programmed into fuses to be used during early-boot flows or
later at runtime. Examples of these security-sensitive values include root keys, encryption keys,
manufacturing-specific information, chip-manufacturer-specific information, and original-equipmentmanufacturer
(OEM) data. After the chip is powered on, these values are sensed from fuses and
stored in temporary locations such as registers and local memories. These locations are typically
access-control protected from untrusted agents capable of accessing them. Even to trusted agents,
only read-access is provided. However, these locations are not blocked during debug operations,
allowing a user to access this sensitive information.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1263 Improper Physical Access Control 2085
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Access Control
Modify Memory
Bypass Protection Mechanism
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
Disable access to security-sensitive information stored in fuses directly and also reflected from
temporary storage locations when in debug mode.
Demonstrative Examples
Example 1:
Sensitive manufacturing data (such as die information) are stored in fuses. When the chip powers
on, these values are read from the fuses and stored in microarchitectural registers. These registers
are only given read access to trusted software running on the core. Untrusted software running on
the core is not allowed to access these registers.
CWE Version 4.14
CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug
CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug