Uninitialized Value on Reset for Registers Holding Security Settings

Opis

Security-critical logic is not set to a known value on reset.

When the device is first brought out of reset, the state of registers will be indeterminate if they have not been initialized by the logic. Before the registers are initialized, there will be a window during which the device is in an insecure state and may be vulnerable to attack.

Skutki

• Access Control, Authentication, Authorization

  Varies by Context

Zapobieganie

• Implementation

  Design checks should be performed to identify any uninitialized flip-flops used for security-critical functions.

• Architecture and Design

  All registers holding security-critical information should be set to a specific value on reset.

Słabość nadrzędna

• CWE-909 Missing Initialization of Resource

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Not OS-Specific, Not Architecture-Specific, Not Technology-Specific

Uwagi

This entry is still under development and will continue to see updates and content improvements.