Internal Asset Exposed to Unsafe Debug Access Level or State

Opis

The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.

Debug authorization can have multiple levels of access, defined such that different system internal assets are accessible based on the current authorized debug level. Other than debugger authentication (e.g., using passwords or challenges), the authorization can also be based on the system state or boot stage. For example, full system debug access might only be allowed early in boot after a system reset to ensure that previous session data is not accessible to the authenticated debugger.

Skutki

• Confidentiality

  Read Memory

  If a protection mechanism does not ensure that internal assets have the correct debug access level during each boot stage or change in system state, an attacker could obtain sensitive information from the internal asset using a debugger.

• Integrity

  Modify Memory

• Authorization, Access Control

  Gain Privileges or Assume Identity; Bypass Protection Mechanism

Zapobieganie

• Architecture and Design, Implementation

  For security-sensitive assets accessible over debug/test interfaces, only allow trusted agents.

  Skuteczność: High

• Architecture and Design

  Apply blinding [REF-1219] or masking techniques in strategic areas.

  Skuteczność: Limited

• Implementation

  Add shielding or tamper-resistant protections to the device, which increases the difficulty and cost for accessing debug/test interfaces.

  Skuteczność: Limited

Przykłady podatności

• CVE-2019-18827 After ROM code execution, JTAG access is disabled. But before the ROM code is executed, JTAG access is possible, allowing a user full system access. This allows a user to modify the boot flow and successfully bypass the secure-boot process.

Słabość nadrzędna

• CWE-863 Incorrect Authorization

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific, Not OS-Specific, Not Architecture-Specific, System on Chip

Uwagi

CWE-1191 and CWE-1244 both involve physical debug access, but the weaknesses are different. CWE-1191 is effectively about missing authorization for a debug interface, i.e. JTAG. CWE-1244 is about providing internal assets with the wrong debug access level, exposing the asset to untrusted debug agents.

Źródła

1. Multiple Vulnerabilities in Barco Clickshare: JTAG access is not permanently disabled — F-Secure Labs
2. Attacks and Defenses for JTAG — Kurt Rosenfeld, Ramesh Karri
3. Blindsight: Blinding EM Side-Channel Leakage using Built-In Fully Integrated Inductive Voltage Regulator — Monodeep Kar, Arvind Singh, Santosh Ghosh, Sanu Mathew, Anand Rajan, Vivek De, Raheem Beyah, Saibal Mukhopadhyay, 2018
4. csr_regile.sv line 938 — 2021
5. Fix for csr_regfile.sv line 938 — 2021