CWE-1239

Common consequences1

• ConfidentialityVaries by Context

  The consequences will depend on the information disclosed due to the vulnerability. When a different entity obtains access to the IP due to a change in operating mode or conditions, the new entity can extract information belonging to the previous user if no mechanisms are in place to clear register contents.

Potential mitigations1

1. Architecture and Design

   It is important to clear information stored in the hardware if a physical attack on the product is detected, or if the user of the hardware block changes. Every register potentially containing sensitive information must have a policy specifying how and when information is cleared, in addition to clarifying if it is the responsibility of the hardware logic or IP user to initiate the zeroization procedure at the appropriate time.

Relationships2

• ChildOfCWE-1272
• CanAlsoBeCWE-1258