2065
if (rst==1'b1)
q<4'b0000;
else
q<a;
end
endmodule
Observed Examples
Reference Description
CVE-2020-12788 CMAC verification vulnerable to timing and power attacks.
https://www.cve.org/CVERecord?id=CVE-2020-12788
Functional Areas
• Power
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1206 Power, Clock, Thermal, and Reset Concerns 1194 2473
MemberOf 1388 Physical Access Issues and Concerns 1194 2518
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Related Attack Patterns
CAPEC-ID Attack Pattern Name
189 Black Box Reverse Engineering
References
[REF-1184]Wikipedia. "Power Analysis". < https://en.wikipedia.org/wiki/Power_analysis >.
CWE-1256: Improper Restriction of Software Interfaces to Hardware Features
Weakness ID : 1256
Structure : Simple
Abstraction : Base
Description
The product provides software-controllable device functionality for capabilities such as power
and clock management, but it does not properly limit functionality that can lead to modification of
hardware memory or register bits, or the ability to observe physical side channels.
Extended Description
It is frequently assumed that physical attacks such as fault injection and side-channel analysis
require an attacker to have physical access to the target device. This assumption may be false
if the device has improperly secured power management features, or similar features. For
mobile devices, minimizing power consumption is critical, but these devices run a wide variety
of applications with different performance requirements. Software-controllable mechanisms to
dynamically scale device voltage and frequency and monitor power consumption are common
features in today's chipsets, but they also enable attackers to mount fault injection and sidechannel
attacks without having physical access to the device.
CWE Version 4.14
CWE-1256: Improper Restriction of Software Interfaces to Hardware Features
CWE-1256: Improper Restriction of Software Interfaces to Hardware Features