CWE-1191On-Chip Debug and Test Interface With Improper Access Control

Description

The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

[object Object]

Common consequences

• Confidentiality→Read Application Data
• Confidentiality→Read Memory
• Authorization→Execute Unauthorized Code or Commands
• Integrity→Modify Memory
• Integrity→Modify Application Data
• Access Control→Bypass Protection Mechanism

Potential mitigations

• Architecture and Design
  If feasible, the manufacturer should disable the JTAG interface or implement authentication and authorization for the JTAG interface. If authentication logic is added, it should be resistant to timing attacks. Security-sensitive data stored in registers, such as keys, etc. should be cleared when entering debug mode.

Related CWEs

Recent CVEs classified under this CWE