CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug
Access to security-sensitive information stored in fuses is not limited during debug.
How it's found
Sensitive Non-Volatile Information Not Protected During Debug is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Several security-sensitive values are programmed into fuses to be used during early-boot flows or later at runtime. Examples of these security-sensitive values include root keys, encryption keys, manufacturing-specific information, chip-manufacturer-specific information, and original-equipment-manufacturer (OEM) data. After the chip is powered on, these values are sensed from fuses and stored in temporary locations such as registers and local memories. These locations are typically access-control protected from untrusted agents capable of accessing them. Even to trusted agents, only read-access is provided.
Vulnerable vs. safe
All microarchitectural registers in this chip can be accessed through the debug interface. As a result, even an untrusted debugger can access this data and retrieve sensitive manufacturing data.Registers used to store sensitive values read from fuses should be blocked during debug. These registers should be disconnected from the debug interface.Consequences
- Modify Memory, Read Memory, Bypass Protection Mechanism: If these locations are not blocked during debug operations, it can allow a user to access this sensitive information.
Mitigations
- Architecture and Design/Implementation: Disable access to security-sensitive information stored in fuses directly and also reflected from temporary storage locations when in debug mode.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-1243?
Access to security-sensitive information stored in fuses is not limited during debug.
How do you find Sensitive Non-Volatile Information Not Protected During Debug?
Sensitive Non-Volatile Information Not Protected During Debug is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-1243?
Modify Memory, Read Memory, Bypass Protection Mechanism: If these locations are not blocked during debug operations, it can allow a user to access this sensitive information.
Does TurboPentest test for Sensitive Non-Volatile Information Not Protected During Debug?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest