2037
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1207 Debug and Test Problems 1194 2474
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
116 Excavation
545 Pull Data from System Resources
References
[REF-1366]"aes0_wrapper.sv". 2021. < https://github.com/HACK-EVENT/hackatdac21/
blob/71103971e8204de6a61afc17d3653292517d32bf/piton/design/chip/tile/ariane/src/aes0/
aes0_wrapper.sv#L56C1-L57C1 >.2023-07-15.
[REF-1367]"fix cwe_1243 in aes0_wrapper.sv". 2021. < https://github.com/HACK-EVENT/
hackatdac21/blob/cde1d9d6888bffab21d4b405ccef61b19c58dd3c/piton/design/chip/tile/ariane/src/
aes0/aes0_wrapper.sv#L56 >.2023-09-28.
CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State
Weakness ID : 1244
Structure : Simple
Abstraction : Base
Description
The product uses physical debug or test interfaces with support for multiple access levels, but it
assigns the wrong debug access level to an internal asset, providing unintended access to the
asset from untrusted debug agents.
Extended Description
Debug authorization can have multiple levels of access, defined such that different system
internal assets are accessible based on the current authorized debug level. Other than debugger
authentication (e.g., using passwords or challenges), the authorization can also be based on
the system state or boot stage. For example, full system debug access might only be allowed
early in boot after a system reset to ensure that previous session data is not accessible to the
authenticated debugger.
If this protection mechanism does not ensure that internal assets have the correct debug access
level during each boot stage or change in system state, an attacker could obtain sensitive
information from the internal asset using a debugger.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State
CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State