544
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
CWE Version 4.14
CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information
CWE-1258: Exposure of Sensitive System
Information Due to Uncleared Debug Information 2072
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
Access Control Bypass Protection Mechanism
Potential Mitigations
Phase: Architecture and Design
Whenever debug mode is enabled, all registers containing sensitive assets must be cleared.
Demonstrative Examples
Example 1:
A cryptographic core in a System-On-a-Chip (SoC) is used for cryptographic acceleration and
implements several cryptographic operations (e.g., computation of AES encryption and decryption,
SHA-256, HMAC, etc.). The keys for these operations or the intermediate values are stored in
registers internal to the cryptographic core. These internal registers are in the Memory Mapped
Input Output (MMIO) space and are blocked from access by software and other untrusted agents
on the SoC. These registers are accessible through the debug and test interface.
Example Language: Other (Bad)
In the above scenario, registers that store keys and intermediate values of cryptographic operations are not cleared when
system enters debug mode. An untrusted actor running a debugger may read the contents of these registers and gain
access to secret keys and other sensitive cryptographic information.
Example Language: Other (Good)
Whenever the chip enters debug mode, all registers containing security-sensitive data are be cleared rendering them
unreadable.
Observed Examples
Reference Description
CVE-2021-33080 Uncleared debug information in memory accelerator for SSD product exposes
sensitive system information
https://www.cve.org/CVERecord?id=CVE-2021-33080
CVE-2022-31162 Rust library leaks Oauth client details in application debug logs
https://www.cve.org/CVERecord?id=CVE-2022-31162
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1207 Debug and Test Problems 1194 2474
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Related Attack Patterns
CAPEC-ID Attack Pattern Name
37 Retrieve Embedded Sensitive Data
CWE Version 4.14
CWE-1259: Improper Restriction of Security Token Assignment
CWE-1259: Improper Restriction of Security Token Assignment