CWE-1272: Sensitive Information Uncleared Before… | Glexia
CWE-1272 (Sensitive Information Uncleared Before Debug/Power State Transition) weakness overview with consequences, detection methods, mitigations, related CVEs…
Glexia's Take · Automated analysis
CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition
Sensitive Information Uncleared Before Debug/Power State Transition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Confidentiality,Integrity,Availability,Access Control,Accountability,Authentication,Authorization,Non-Repudiation: Read Memory,Read Application Data: Sensitive information may be used to unlock additional capabilities of the device and take advantage of hidden functionalities which could be used to compromise device security.
Developer Pattern
CWE-1272 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Automation confidence
high confidence from CWE-1272, 4.20.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Official CWE Definition
CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition
The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- This example shows how an attacker can take advantage of an incorrect state transition. ,
Remediation
- Architecture and Design,Implementation: During state transitions, information not needed in the next state should be removed before the transition to the next state.
Detection
- Manual Analysis: Write a known pattern into each sensitive location. Enter the power/debug state in question. Read data back from the sensitive locations. If the reads are successful, and the data is the same as the pattern that was originally written, the test fails and the device needs to be fixed. Note that this test can likely be automated.
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.