CWEweakness

CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The hardware product enters debug mode but does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations.

Extended description

Security sensitive values, keys, intermediate steps of cryptographic operations, etc. are stored in temporary registers in the hardware.

Common consequences

• Confidentiality: Read Memory — Sensitive data could be accessed by a debugger, allowing sensitive information to be accessible by untrusted parties. • Access Control: Bypass Protection Mechanism

Potential mitigations

• [Architecture and Design] Whenever debug mode is enabled, all registers containing sensitive assets must be cleared.

Observed examples

• CVE-2021-33080: Uncleared debug information in memory accelerator for SSD product exposes sensitive system information • CVE-2022-31162: Rust library leaks Oauth client details in application debug logs

Related

Attack pattern · CAPEC (4)

  • CAPEC-150 Collect Data from Common Resource Locations attack pattern
  • CAPEC-204 Lifting Sensitive Data Embedded in Cache attack pattern
  • CAPEC-37 Retrieve Embedded Sensitive Data attack pattern
  • CAPEC-545 Pull Data from System Resources attack pattern

Observed example · CVE (2)

  • CVE-2022-31162 Slack Morphism is an async client library for Rust. vulnerability
  • CVE-2021-33080 Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD… vulnerability

Can also be · CWE (1)

  • CWE-1239 Improper Zeroization of Hardware Register weakness

Child of · CWE (1)

  • CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition weakness

Referenced by CAPEC · weakness (4)

  • CAPEC-150 Collect Data from Common Resource Locations attack pattern
  • CAPEC-204 Lifting Sensitive Data Embedded in Cache attack pattern
  • CAPEC-37 Retrieve Embedded Sensitive Data attack pattern
  • CAPEC-545 Pull Data from System Resources attack pattern

Referenced by CVE · weakness (16)

  • CVE-2026-65127 NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information… vulnerability
  • CVE-2026-79727 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of… vulnerability
  • CVE-2026-80239 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of… vulnerability
  • CVE-2026-66432 Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions. vulnerability
  • CVE-2026-52696 Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions. vulnerability
  • CVE-2025-14551 In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. vulnerability
  • CVE-2025-15480 In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. vulnerability
  • CVE-2026-26948 Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.174, 15G and 16G versions prior to 7.10.90.00, contain an… vulnerability
  • CVE-2025-26482 Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. vulnerability
  • CVE-2025-32257 Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration… vulnerability
  • CVE-2024-36912 In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl In CoCo VMs… vulnerability
  • CVE-2024-36913 In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo… vulnerability
  • CVE-2023-48308 Nextcloud/Cloud is a calendar app for Nextcloud. vulnerability
  • CVE-2022-43666 Exposure of sensitive system information due to uncleared debug information for some Intel Unison software may allow an authenticated user… vulnerability
  • CVE-2022-39292 Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. vulnerability
  • CVE-2022-31162 Slack Morphism is an async client library for Rust. vulnerability

Referenced by CWE · can also be (1)

  • CWE-1239 Improper Zeroization of Hardware Register weakness

Referenced by CWE · peer of (1)

  • CWE-1431 Driving Intermediate Cryptographic State/Results to Hardware Module Outputs weakness