On-Chip Debug and Test Interface With Improper Access Control

Opis

The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

A device's internal information may be accessed through a scan chain of interconnected internal registers, usually through a JTAG interface. The JTAG interface provides access to these registers in a serial fashion in the form of a scan chain for the purposes of debugging programs running on a device. Since almost all information contained within a device may be accessed over this interface, device manufacturers typically insert some form of authentication and authorization to prevent unintended use of this sensitive information. This mechanism is implemented in addition to on-chip protections that are already present.

If authorization, authentication, or some other form of access control is not implemented or not implemented correctly, a user may be able to bypass on-chip protection mechanisms through the debug interface.

Sometimes, designers choose not to expose the debug pins on the motherboard. Instead, they choose to hide these pins in the intermediate layers of the board. This is primarily done to work around the lack of debug authorization inside the chip. In such a scenario (without debug authorization), when the debug interface is exposed, chip internals are accessible to an attacker.

Skutki

• Confidentiality

  Read Application Data

• Confidentiality

  Read Memory

• Authorization

  Execute Unauthorized Code or Commands

• Integrity

  Modify Memory

• Integrity

  Modify Application Data

• Access Control

  Bypass Protection Mechanism

Zapobieganie

• Architecture and Design · Separation of Privilege

  If feasible, the manufacturer should disable the JTAG interface or implement authentication and authorization for the JTAG interface. If authentication logic is added, it should be resistant to timing attacks. Security-sensitive data stored in registers, such as keys, etc. should be cleared when entering debug mode.

  Skuteczność: High

Przykłady podatności

• CVE-2019-18827 chain: JTAG interface is not disabled (CWE-1191) during ROM code execution, introducing a race condition (CWE-362) to extract encryption keys

Słabość nadrzędna

• CWE-284 Improper Access Control

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific, Not OS-Specific, Not Architecture-Specific, Not Technology-Specific

Uwagi

CWE-1191 and CWE-1244 both involve physical debug access, but the weaknesses are different. CWE-1191 is effectively about missing authorization for a debug interface, i.e. JTAG. CWE-1244 is about providing internal assets with the wrong debug access level, exposing the asset to untrusted debug agents.

Źródła

1. Attacks and Defenses for JTAG — Kurt Rosenfeld, Ramesh Karri, 2010
2. Exploiting JTAG and Its Mitigation in IOT: A Survey — Gopal Vishwakarma, Wonjun Lee, 2018
3. JTAG Explained (finally!): Why "IoT", Software Security Engineers, and Manufacturers Should Care — Gopal Vishwakarma, Wonjun Lee
4. Design for Testability & Design for Debug — Bob Molyneaux, Mark McDermott, Anil Sabbavarapu
5. dmi_jtag.sv — Florian Zaruba, 2021
6. Fix CWE-1191 in dmi_jtag.sv — Florian Zaruba, 2021
7. Fix CWE-1191 in dmi_jtag.sv — Florian Zaruba, 2021
8. dmi_jtag.sv — Florian Zaruba, 2021
9. dmi_jtag.sv — 2021
10. fix cwe_1205 in dmi_jtag.sv — 2021