CWE Database
/

CWE-1272

Back to CWE list

CWE-1272

Sensitive Information Uncleared Before Debug/Power State Transition

Base
Stable

Description

The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.

{"xhtml:p":["A device or system frequently employs many power and sleep states during its normal operation (e.g., normal power, additional power, low power, hibernate, deep sleep, etc.). A device also may be operating within a debug condition. State transitions can happen from one power or debug state to another. If there is information available in the previous state which should not be available in the next state and is not properly removed before the transition into the next state, sensitive information may leak from the system."]}

Related Weaknesses

Common Consequences

Scope

Confidentiality
Integrity
Availability
Access Control
Accountability
Authentication
Authorization
Non-Repudiation

Impact

Read Memory, Read Application Data

Potential Mitigations

Architecture and Design
Implementation

During state transitions, information not needed in the next state should be removed before the transition to the next state.

CVE-2020-12926

Product software does not set a flag as per TPM specifications, thereby preventing a failed authorization attempt from being recorded after a loss of power.

Applicable Platforms

VHDL
Verilog
Hardware Description Language

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now