CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition
The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.
Last updated
Overview
A device or system frequently employs many power and sleep states during its normal operation (e.g., normal power, additional power, low power, hibernate, deep sleep, etc.). A device also may be operating within a debug condition. State transitions can happen from one power or debug state to another. If there is information available in the previous state which should not be available in the next state and is not properly removed before the transition into the next state, sensitive information may leak from the system.
Real-world CVEs
2 recorded CVEs are caused by CWE-1272 (Sensitive Information Uncleared Before Debug/Power State Transition). The highest-severity and most recent are shown first.
Common consequences
What can happen when CWE-1272 is exploited.
Read Memory, Read Application Data
Affects: Confidentiality, Integrity, Availability, Access Control, Accountability, Authentication, Authorization, Non-Repudiation
Sensitive information may be used to unlock additional capabilities of the device and take advantage of hidden functionalities which could be used to compromise device security.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Languages
How to prevent it
Practical mitigations for CWE-1272, grouped by where in the lifecycle they apply.
During state transitions, information not needed in the next state should be removed before the transition to the next state.
How to detect it
Manual Analysis
Write a known pattern into each sensitive location. Enter the power/debug state in question. Read data back from the sensitive locations. If the reads are successful, and the data is the same as the pattern that was originally written, the test fails and the device needs to be fixed. Note that this test can likely be automated.
Effectiveness: High
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
This example shows how an attacker can take advantage of an incorrect state transition.
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2020-12926 — Product software does not set a flag as per TPM specifications, thereby preventing a failed authorization attempt from being recorded after a loss of power.
Attack patterns
CAPEC attack patterns that exploit this weakness.
Frequently asked questions
Common questions about CWE-1272.
- What is CWE-1272?
- The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.
- What CVEs are caused by CWE-1272?
- 2 recorded CVEs are attributed to CWE-1272, including CVE-2020-22656, CVE-2023-41967.
- How do you prevent CWE-1272?
- During state transitions, information not needed in the next state should be removed before the transition to the next state.
- How is CWE-1272 detected?
- Manual Analysis: Write a known pattern into each sensitive location. Enter the power/debug state in question. Read data back from the sensitive locations. If the reads are successful, and the data is the same as the pattern that was originally written, the test fails and the device needs to be fixed. Note that this test can likely be automated.
- What are the consequences of CWE-1272?
- Exploiting CWE-1272 can lead to: Read Memory, Read Application Data.
- Is CWE-1272 actively exploited?
- 2 recorded CVEs are caused by CWE-1272; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-1272) (opens in a new tab)
- CWE-1272 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-1272
Get alerted the moment a new CWE-1272 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.