2038
Nature Type ID Name Page
ChildOf 863 Incorrect Authorization 1787
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : System on Chip (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
Integrity Modify Memory
Authorization
Access Control
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Detection Methods
Manual Analysis
Check 2 devices for their passcode to authenticate access to JTAG/debugging ports. If the
passcodes are missing or the same, update the design to fix and retest. Check communications
over JTAG/debugging ports for encryption. If the communications are not encrypted, fix the
design and retest.
Effectiveness = Moderate
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
For security-sensitive assets accessible over debug/test interfaces, only allow trusted agents.
Effectiveness = High
Phase: Architecture and Design
Apply blinding [REF-1219] or masking techniques in strategic areas.
Effectiveness = Limited
Phase: Implementation
Add shielding or tamper-resistant protections to the device, which increases the difficulty and
cost for accessing debug/test interfaces.
Effectiveness = Limited
Demonstrative Examples
Example 1:
The JTAG interface is used to perform debugging and provide CPU core access for developers.
JTAG-access protection is implemented as part of the JTAG_SHIELD bit in the hw_digctl_ctrl
register. This register has no default value at power up and is set only after the system boots from
ROM and control is transferred to the user software.
CWE Version 4.14
CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State
CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State