Weakness · High
CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information
What it is
The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
Security sensitive values, keys, intermediate steps of cryptographic operations, etc. are stored in temporary registers in the hardware. If these values are not cleared when debug mode is entered they may be accessed by a debugger allowing sensitive information to be accessible by untrusted parties.
What an attacker can do
- Read Memory (Confidentiality)
- Bypass Protection Mechanism (Access Control)
How to prevent it
Architecture and Design
- Whenever debug mode is enabled, all registers containing sensitive assets must be cleared.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.