CWE-1296: Incorrect Chaining or Granularity of Debug Components

In more detail

For debugging and troubleshooting a chip, several hardware design elements are often implemented, including: Various Test Access Ports (TAPs) allow boundary scan commands to be executed. For scanning the internal components of a chip, there are scan cells that allow the chip to be used as a "stimulus and response" mechanism. Chipmakers might create custom methods to observe the internal components of their chips by placing various tracing hubs within their chip and creating hierarchical or interconnected structures among those hubs. Logic errors during design or synthesis could misconfigure the interconnection of the debug components, which could allow unintended access permissions.

What an attacker can do

• Gain Privileges or Assume Identity (Confidentiality, Integrity, Access Control, Authentication, Authorization, Availability, Accountability)
• Bypass Protection Mechanism (Confidentiality, Integrity, Access Control, Authentication, Authorization, Availability, Accountability)
• Execute Unauthorized Code or Commands (Confidentiality, Integrity, Access Control, Authentication, Authorization, Availability, Accountability)
• Modify Memory (Confidentiality, Integrity, Access Control, Authentication, Authorization, Availability, Accountability)
• Modify Files or Directories (Confidentiality, Integrity, Access Control, Authentication, Authorization, Availability, Accountability)

How to prevent it

How to find it

• Architecture or Design Review. Appropriate Post-Si tests should be carried out at various authorization levels to ensure that debug components are properly chained and accessible only to users with appropriate credentials.
• Dynamic Analysis with Manual Results Interpretation. Appropriate Post-Si tests should be carried out at various authorization levels to ensure that debug components are properly chained and accessible only to users with appropriate credentials.

CWE-1296 on MITRE's CWE site