2107
purpose of troubleshooting device problems. For example, suppose a device contains the ability
to dump the content of the full system memory by disabling the memory-protection mechanisms.
Since this is a highly security-sensitive capability, this capability is "locked" in the production part.
Unless the device gets unlocked by supplying the proper credentials, the debug capabilities are not
available. For cases where the chip designer, chip manufacturer (fabricator), and manufacturing
and assembly testers are all employed by the same company, the risk of compromise of the
credentials is greatly reduced. However, the risk is greater when the chip designer is employed
by one company, the chip manufacturer is employed by another company (a foundry), and the
assemblers and testers are employed by yet a third company. Since these different companies
will need to perform various tests on the device to verify correct device function, they all need to
share the unlock key. Unfortunately, the level of secrecy and policy might be quite different at each
company, greatly increasing the risk of sensitive credentials being compromised.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 200 Exposure of Sensitive Information to an Unauthorized Actor 504
Applicable Platforms
Language : VHDL (Prevalence = Undetermined)
Language : Verilog (Prevalence = Undetermined)
Language : Compiled (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Other (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Access Control
Accountability
Authentication
Authorization
Non-Repudiation
Modify Memory
Read Memory
Modify Files or Directories
Read Files or Directories
Modify Application Data
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Once unlock credentials are compromised, an attacker
can use the credentials to unlock the device and gain
unauthorized access to the hidden functionalities protected
by those credentials.
Potential Mitigations
Phase: Integration
Ensure the unlock credentials are shared with the minimum number of parties and with utmost
secrecy. To limit the risk associated with compromised credentials, where possible, the
credentials should be part-specific.
CWE Version 4.14
CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code
CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code