2209
debugger can access these traces and extract secret information. Additionally, if security-sensitive
traces are not tagged as secure, an untrusted hardware debugger might access them to extract
confidential information.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : System on Chip (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
An adversary can read secret values if they are captured in
debug traces and stored unsafely.
Potential Mitigations
Phase: Implementation
Tag traces to indicate owner and debugging privilege level (designer, OEM, or end user) needed
to access that trace.
Demonstrative Examples
Example 1:
In a SoC, traces generated from sources include security-sensitive IP blocks such as CPU
(with tracing information such as instructions executed and memory operands), on-chip fabric
(e.g., memory-transfer signals, transaction type and destination, and on-chip-firewall-error
signals), power-management IP blocks (e.g., clock- and power-gating signals), and cryptographic
coprocessors (e.g., cryptographic keys and intermediate values of crypto operations), among other
non-security-sensitive IP blocks including timers and other functional blocks. The collected traces
are then forwarded to the debug and trace interface used by the external hardware debugger.
Example Language: Other (Bad)
The traces do not have any privilege level attached to them. All collected traces can be viewed by any debugger (i.e., SoC
designer, OEM debugger, or end user).
Example Language: Other (Good)
Some of the traces are SoC-design-house secrets, while some are OEM secrets. Few are end-user secrets and the rest are
not security-sensitive. Tag all traces with the appropriate, privilege level at the source. The bits indicating the privilege level
must be immutable in their transit from trace source to the final, trace sink. Debugger privilege level must be checked before
providing access to traces.
MemberOf Relationships
CWE Version 4.14
CWE-1325: Improperly Controlled Sequential Memory Allocation
CWE-1325: Improperly Controlled Sequential Memory Allocation