logo

CWE-1191 - On-Chip Debug and Test Interface With Improper Access Control

CWE-1191

  • Abstraction:
  • Base
  • Structure:
  • Simple
  • Status:
  • Stable
Weakness Name

On-Chip Debug and Test Interface With Improper Access Control

Description

The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

A device's internal information may be accessed through a scan chain of interconnected internal registers, usually through a JTAG interface. The JTAG interface provides access to these registers in a serial fashion in the form of a scan chain for the purposes of debugging programs running on a device. Since almost all information contained within a device may be accessed over this interface, device manufacturers typically insert some form of authentication and authorization to prevent unintended use of this sensitive information. This mechanism is implemented in addition to on-chip protections that are already present. If authorization, authentication, or some other form of access control is not implemented or not implemented correctly, a user may be able to bypass on-chip protection mechanisms through the debug interface. Sometimes, designers choose not to expose the debug pins on the motherboard. Instead, they choose to hide these pins in the intermediate layers of the board. This is primarily done to work around the lack of debug authorization inside the chip. In such a scenario (without debug authorization), when the debug interface is exposed, chip internals are accessible to an attacker.

Common Consequences

Scope: Confidentiality

Impact: Read Application Data

Scope: Confidentiality

Impact: Read Memory

Scope: Authorization

Impact: Execute Unauthorized Code or Commands

Scope: Integrity

Impact: Modify Memory

Scope: Integrity

Impact: Modify Application Data

Scope: Access Control

Impact: Bypass Protection Mechanism

Related Weaknesses
  • Release Date:
  • 2020-02-24
  • Latest Modification Date:
  • 2023-10-26

Free security scan for your website