CWE-1239 Improper Zeroization of Hardware Register

The hardware product does not properly clear sensitive information from built-in registers when the user of the hardware block changes.

• Confidentiality: Varies by Context — The consequences will depend on the information disclosed due to the vulnerability. When a different entity obtains access to the IP due to a change in operating mode or conditions, the new entity can extract information belonging to the previous user if no mechanisms are in place to clear register contents.

• [Architecture and Design] It is important to clear information stored in the hardware if a physical attack on the product is detected, or if the user of the hardware block changes. Every register potentially containing sensitive information must have a policy specifying how and when information is cleared, in addition to clarifying if it is the responsibility of the hardware logic or IP user to initiate the zeroization procedure at the appropriate time.