CWE-1244 Internal Asset Exposed to Unsafe Debug Access Level or State

The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.

• Confidentiality: Read Memory — If a protection mechanism does not ensure that internal assets have the correct debug access level during each boot stage or change in system state, an attacker could obtain sensitive information from the internal asset using a debugger. • Integrity: Modify Memory • Authorization, Access Control: Gain Privileges or Assume Identity, Bypass Protection Mechanism

• [Architecture and Design, Implementation] For security-sensitive assets accessible over debug/test interfaces, only allow trusted agents. • [Architecture and Design] Apply blinding [REF-1219] or masking techniques in strategic areas. • [Implementation] Add shielding or tamper-resistant protections to the device, which increases the difficulty and cost for accessing debug/test interfaces.

• Manual Analysis: Check 2 devices for their passcode to authenticate access to JTAG/debugging ports. If the passcodes are missing or the same, update the design to fix and retest. Check communications over JTAG/debugging ports for encryption. If the communications are not encrypted, fix the design and retest.

• CVE-2019-18827: After ROM code execution, JTAG access is disabled. But before the ROM code is executed, JTAG access is possible, allowing a user full system access. This allows a user to modify the boot flow and successfully bypass the secure-boot process.