CWE Database
/

CWE-1258

Back to CWE list

CWE-1258

Exposure of Sensitive System Information Due to Uncleared Debug Information

Base
Draft

Description

The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered.

{"xhtml:p":["Security sensitive values, keys, intermediate steps of cryptographic operations, etc. are stored in temporary registers in the hardware. If these values are not cleared when debug mode is entered they may be accessed by a debugger allowing sensitive information to be accessible by untrusted parties."]}

Common Consequences

Scope

Confidentiality

Impact

Read Memory

Scope

Access Control

Impact

Bypass Protection Mechanism

Potential Mitigations

Architecture and Design

Whenever debug mode is enabled, all registers containing sensitive assets must be cleared.

CVE-2021-33080

Uncleared debug information in memory accelerator for SSD product exposes sensitive system information

CVE-2022-31162

Rust library leaks Oauth client details in application debug logs

Applicable Platforms

Not Language-Specific

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now