Weakness · Medium
CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition
What it is
The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.
- Severity (our rating)
- Medium
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
A device or system frequently employs many power and sleep states during its normal operation (e.g., normal power, additional power, low power, hibernate, deep sleep, etc.). A device also may be operating within a debug condition. State transitions can happen from one power or debug state to another. If there is information available in the previous state which should not be available in the next state and is not properly removed before the transition into the next state, sensitive information may leak from the system.
What an attacker can do
- Read Memory (Confidentiality, Integrity, Availability, Access Control, Accountability, Authentication, Authorization, Non-Repudiation)
- Read Application Data (Confidentiality, Integrity, Availability, Access Control, Accountability, Authentication, Authorization, Non-Repudiation)
How to prevent it
Architecture and Design
- During state transitions, information not needed in the next state should be removed before the transition to the next state.
How to find it
- Manual Analysis. Write a known pattern into each sensitive location. Enter the power/debug state in question. Read data back from the sensitive locations. If the reads are successful, and the data is the same as the pattern that was originally written, the test fails and the device needs to be fixed. Note that this test can likely be automated.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.