CWE-1191: On-Chip Debug and Test Interface With Improper Access Control

Description:
The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

Extended Description:
A device's internal information may be accessed through a scan chain of interconnected internal registers, usually through a JTAG interface. The JTAG interface provides access to these registers in a serial fashion in the form of a scan chain for the purposes of debugging programs running on a device. Since almost all information contained within a device may be accessed over this interface, device manufacturers typically insert some form of authentication and authorization to prevent unintended use of this sensitive information. This mechanism is implemented in addition to on-chip protections that are already present. 
       If authorization, authentication, or some other form of access control is not implemented or not implemented correctly, a user may be able to bypass on-chip protection mechanisms through the debug interface. 
       Sometimes, designers choose not to expose the debug pins on the motherboard. Instead, they choose to hide these pins in the intermediate layers of th

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-284

Consequences:
  - Confidentiality: Read Application Data
  - Confidentiality: Read Memory
  - Authorization: Execute Unauthorized Code or Commands
  - Integrity: Modify Memory
  - Integrity: Modify Application Data

Detection methods:
  - Dynamic Analysis with Manual Results Interpretation: Authentication and authorization of debug and test interfaces should be part of the architecture and design review process. Withholding of private register documentation from the debug and test interf
  - Dynamic Analysis with Manual Results Interpretation: Dynamic tests should be done in the pre-silicon and post-silicon stages to verify that the debug and test interfaces are not open by default.
  - Fuzzing: Tests that fuzz Debug and Test Interfaces should ensure that no access without appropriate authentication and authorization is possible.

Mitigations:
  - [Architecture and Design] If feasible, the manufacturer should disable the JTAG interface or implement authentication and authorization for the JTAG interface. If authentication logic is added, it should be resistant to timing attacks. Security-sensitive data stored in registers, such as keys, etc. should be cleared when ent

Demonstrative examples:
A home, WiFi-router device implements a login prompt which prevents an unauthorized user from issuing any commands on the device until appropriate credentials are provided. The credentials are protected on the device and are checked for strength against attack.
JTAG is useful to chip and device manufacturers during design, testing, and production and is included in nearly every product. Without proper authentication and authorization, the interface may allow tampering with a product.
If the JTAG interface on this device is not hidden by the manufacturer, the interface may be identified using tools such as JTAGulator. If it is hidden but not disabled, it can be exposed by physically wiring to the board. 
	   By issuing a "halt" command before the OS starts, the unauthorized user pauses the 

The following example code is a snippet from the JTAG wrapper module in the RISC-V debug module of the HACK@DAC'21 Openpiton SoC [REF-1355]. To make sure that the JTAG is accessed securely, the developers have included a primary authentication mechanism based on a password.
The developers employed a Finite State Machine (FSM) to implement this authentication. When a user intends to read from or write to the JTAG module, they must input a password.
... 
			 PassChkValid: begin 
				 if(hashValid) begin 
					 if(exp_hash == pass_hash) begin 
						 pass_check = 1'b1; 
						 end else begin 
						 pass_check = 1'b0; 
						 end 
						state_d = Idle; 
						 
					end else begin
						 state_d = PassChkValid; 
					end 
				end 
			...
... 
			case (state_q)
				 Idle: begin 
				...
					 

Real-world examples:
  - CVE-2019-18827: chain: JTAG interface is not disabled (CWE-1191) during ROM code execution, introducing a race condition (CWE-362) to extract encryption keys