CWE-1323 Improper Management of Sensitive Trace Data

Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected locations or transported to untrusted agents.

• Confidentiality: Read Memory — An adversary can read secret values if they are captured in debug traces and stored unsafely. If trace data (such as from debug) is stored in unprotected memory, an untrusted software debugger can access these traces and extract secret information. Additionally, if security-sensitive traces are not tagged as secure, an untrusted hardware debugger might access them to extract confidential information.

• [Implementation] Since these traces are collected from several security-sensitive sources, they must be protected against untrusted debuggers. Tag traces to indicate owner and debugging privilege level (designer, OEM, or end user) needed to access that trace.