CWE-1244: Improper Authorization on Physical Debug and Test Interfaces
Weakness ID: 1244
Abstraction: Base Structure: Simple
Status: Incomplete
Presentation Filter:
Description
The product's physical debug and test interface protection does not block untrusted agents, resulting in unauthorized access to and potentially control of sensitive assets.
Extended Description
If the product implements access-control protection on the debug and test interface, a debugger is typically required to enter either a valid response to a challenge provided by the authorization logic or, alternatively, enter the right password in order to exercise the debug and test interface. However, if this protection mechanism does not exclude all untrusted, debug agents, an attacker could access/control security-sensitive registers.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
Relevant to the view "Research Concepts" (CWE-1000)
Nature
Type
ID
Name
ChildOf
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
Phase
Note
Architecture and Design
Implementation
Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.
The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
Scope
Impact
Likelihood
Confidentiality
Technical Impact: Read Memory
Integrity
Technical Impact: Modify Memory
Authorization Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
Demonstrative Examples
Example 1
JTAG interface is used to perform debugging and providing insights into the CPU core for developers. JTAG-access protection is implemented as part of the JTAG_SHIELD bit in the register hw_digctl_ctrl REGISTER. This register is not set by default and is set after the system boots from ROM, and control is transferred to the user software.
(bad code)
Example Language: Other
1 bit
0x0 = JTAG debugger is enabled (default)
JTAG_SHIELD
0x1 = JTAG debugger is disabled
This means that end user has access to JTAG at system reset and during ROM code execution before control is transferred to user software. With this loophole, an attacker can modify the boot flow and subsequently disclose data-encryption keys.
(informative)
The default value of this register bit should be set to 1. This prevents JTAG being enabled at system reset.
JTAG access is disabled after ROM code execution. This means that JTAG access is possible when the system is running code from ROM before transferring control over to embedded firmware. This allows an attacker to modify boot flow and successfully bypass secure-boot process.
Potential Mitigations
Phases: Architecture and Design; Implementation
For security-sensitive assets accessible over debug/test interfaces, only allow trusted agents.
Description
