Debug and Test Problems
A category in the Common Weakness Enumeration published by The MITRE Corporation.
Summary
Categories in the Common Weakness Enumeration (CWE) group entries based on some common characteristic or attribute.
Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.
Weaknesses
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.
The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered.
During runtime, the hardware allows for test or debug logic (feature) to be activated, which allows for changing the state of the hardware. This feature can alter the ...
System configuration protection may be bypassed during debug mode.
Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected locations or transported to untrusted ag...
The product's debug components contain incorrect chaining or granularity of debug components.
The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal ...
The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the ...
The same public key is used for signing both debug and production code.
The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information a...
Access to security-sensitive information stored in fuses is not limited during debug.
Concepts
This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectiv...
Common Weakness Enumeration content on this website is copyright of The MITRE Corporation unless otherwise specified. Use of the Common Weakness Enumeration and the associated references on this website are subject to the Terms of Use as specified by The MITRE Corporation.