Description
The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.
A device's internal information may be accessed through a scan chain of interconnected internal registers, usually through a JTAG interface. The JTAG interface provides access to these registers in a serial fashion in the form of a scan chain for the purposes of debugging programs running on a device. Since almost all information contained within a device may be accessed over this interface, device manufacturers typically insert some form of authentication and authorization to prevent unintended use of this sensitive information. This mechanism is implemented in addition to on-chip protections that are already present. If authorization, authentication, or some other form of access control is not implemented or not implemented correctly, a user may be able to bypass on-chip protection mechanisms through the debug interface. Sometimes, designers choose not to expose the debug pins on the motherboard. Instead, they choose to hide these pins in the intermediate layers of the board. This is primarily done to work around the lack of debug authorization inside the chip. In such a scenario (without debug authorization), when the debug interface is exposed, chip internals are accessible to an attacker.
Potential Impact
Confidentiality
Read Application Data
Confidentiality
Read Memory
Authorization
Execute Unauthorized Code or Commands
Integrity
Modify Memory
Integrity
Modify Application Data
Access Control
Bypass Protection Mechanism
Demonstrative Examples
If the JTAG interface on this device is not hidden by the manufacturer, the interface may be identified using tools such as JTAGulator. If it is hidden but not disabled, it can be exposed by physically wiring to the board.
By issuing a "halt" command before the OS starts, the unauthorized user pauses the watchdog timer and prevents the router from restarting (once the watchdog timer would have expired). Having paused the router, an unauthorized user is able to execute code and inspect and modify data in the device, even extracting all of the router's firmware. This allows the user to examine the router and potentially exploit it.In order to prevent exposing the debugging interface, manufacturers might try to obfuscate the JTAG interface or blow device internal fuses to disable the JTAG interface. Adding authentication and authorization to this interface makes use by unauthorized individuals much more difficult....
PassChkValid: begin
if(hashValid) begin
if(exp_hash == pass_hash) begin
pass_check = 1'b1;
end else begin
pass_check = 1'b0;
end
state_d = Idle;
end else begin
state_d = PassChkValid;
end
end
......
case (state_q)
Idle: begin
...
else if ( (dm::dtm_op_e'(dmi.op) == dm::DTM_PASS) && (miss_pass_check_cnt_q != 2'b11) )
begin
state_d = Write;pass_mode = 1'b1;
end
...
end
...
PassChkValid: begin
if(hashValid) begin
if(exp_hash == pass_hash) begin
pass_check = 1'b1;
end else begin
pass_check = 1'b0;
miss_pass_check_cnt_d = miss_pass_check_cnt_q + 1
end
state_d = Idle;
end else begin
state_d = PassChkValid;
end
end
......
logic [31-1:0] data_d, data_q;
...
logic [512-1:0] pass_data;
...
Write: begin
...
if (pass_mode) begin
pass_data = { {60{8'h00}}, data_d};
state_d = PassChk;
pass_mode = 1'b0;
...
end
......
logic [512-1:0] data_d, data_q;
...
logic [512-1:0] pass_data;
...
Write: begin
...
if (pass_mode) begin
pass_data = data_d;
state_d = PassChk;
pass_mode = 1'b0;
...
end
...Mitigations & Prevention
If feasible, the manufacturer should disable the JTAG interface or implement authentication and authorization for the JTAG interface. If authentication logic is added, it should be resistant to timing attacks. Security-sensitive data stored in registers, such as keys, etc. should be cleared when entering debug mode.
Detection Methods
- Dynamic Analysis with Manual Results Interpretation — Authentication and authorization of debug and test interfaces should be part of the architecture and design review process. Withholding of private register documentation from the debug and test interface public specification ("Security by obscurity") should not be considered as sufficient security.
- Dynamic Analysis with Manual Results Interpretation — Dynamic tests should be done in the pre-silicon and post-silicon stages to verify that the debug and test interfaces are not open by default.
- Fuzzing Moderate — Tests that fuzz Debug and Test Interfaces should ensure that no access without appropriate authentication and authorization is possible.
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2019-18827 | chain: JTAG interface is not disabled (CWE-1191) during ROM code execution, introducing a race condition (CWE-362) to extract encryption keys |
Related Weaknesses
Frequently Asked Questions
What is CWE-1191?
CWE-1191 (On-Chip Debug and Test Interface With Improper Access Control) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.
How can CWE-1191 be exploited?
Attackers can exploit CWE-1191 (On-Chip Debug and Test Interface With Improper Access Control) to read application data. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.
How do I prevent CWE-1191?
Key mitigations include: If feasible, the manufacturer should disable the JTAG interface or implement authentication and authorization for the JTAG interface. If authentication logic is added, it should be resistant to timing
What is the severity of CWE-1191?
CWE-1191 is classified as a Base-level weakness (Medium abstraction). It has been observed in 1 real-world CVEs.