Weakness · High
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control
What it is
The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
A device's internal information may be accessed through a scan chain of interconnected internal registers, usually through a JTAG interface. The JTAG interface provides access to these registers in a serial fashion in the form of a scan chain for the purposes of debugging programs running on a device. Since almost all information contained within a device may be accessed over this interface, device manufacturers typically insert some form of authentication and authorization to prevent unintended use of this sensitive information. This mechanism is implemented in addition to on-chip protections that are already present. If authorization, authentication, or some other form of access control is not implemented or not implemented correctly, a user may be able to bypass on-chip protection mechanisms through the debug interface. Sometimes, designers choose not to expose the debug pins on the motherboard. Instead, they choose to hide these pins in the intermediate layers of the board. This is primarily done to work around the lack of debug authorization inside the chip. In such a scenario (without debug authorization), when the debug interface is exposed, chip internals are accessible to an attacker.
What an attacker can do
- Read Application Data (Confidentiality)
- Read Memory (Confidentiality)
- Execute Unauthorized Code or Commands (Authorization)
- Modify Memory (Integrity)
- Modify Application Data (Integrity)
- Bypass Protection Mechanism (Access Control)
How to prevent it
Architecture and Design
- If feasible, the manufacturer should disable the JTAG interface or implement authentication and authorization for the JTAG interface. If authentication logic is added, it should be resistant to timing attacks. Security-sensitive data stored in registers, such as keys, etc. should be cleared when entering debug mode.
How to find it
- Dynamic Analysis with Manual Results Interpretation. Authentication and authorization of debug and test interfaces should be part of the architecture and design review process. Withholding of private register documentation from the debug and test interface public specification ("Security by obscurity") should not be considered as sufficient security.
- Dynamic Analysis with Manual Results Interpretation. Dynamic tests should be done in the pre-silicon and post-silicon stages to verify that the debug and test interfaces are not open by default.
- Fuzzing. Tests that fuzz Debug and Test Interfaces should ensure that no access without appropriate authentication and authorization is possible.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.