Name: Improper Handling of Hardware Behavior in Exceptionally Cold Environments

The hardware device, or the firmware running on it, is missing or has incorrect protection mechanisms to maintain goals of security primitives when the device is cooled below standard operating temperatures.

Allgemeine Informationen

Einführungsmodi

Architecture and Design
Implementation

Anwendbare Plattformen

Sprache

Klasse: Not Language-Specific (Undetermined)

Betriebssysteme

Klasse: Not OS-Specific (Undetermined)

Architekturen

Klasse: Embedded (Undetermined)
Klasse: Microcomputer (Undetermined)

Technologien

Klasse: System on Chip (Undetermined)

Häufige Konsequenzen

Bereich	Auswirkung	Wahrscheinlichkeit
Integrity Authentication	Varies by Context, Unexpected State Hinweis: This may result in a weakness when the starting state of the volatile memory is being relied upon for a security decision. Consequences of this weakness are highly contextual.	Low

Mögliche Gegenmaßnahmen

Phases : Architecture and Design
The system should account for security primitive behavior when cooled outside standard temperatures.

Hinweise zur Schwachstellen-Zuordnung

Begründung : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Kommentar :

Verwandte Angriffsmuster

CAPEC ID	Name des Angriffsmusters
CAPEC-624	Hardware Fault Injection The adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient temperature extremes, and more. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information.
CAPEC-625	Mobile Device Fault Injection Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.

Referenzen

REF-1181

Low-Temperature Data Remnanence Attacks Against Intrinsic SRAM PUFs
Nikolaos Athanasios Anagnostopoulos, Tolga Arul, Markus Rosenstihl, André Schaller, Sebastian Gabmeyer, Stefan Katzenbeisser.
https://ieeexplore.ieee.org/abstract/document/8491873/

REF-1182

A Fully Digital Physical Unclonable Function Based Temperature Sensor for Secure Remote Sensing
Yuan Cao, Yunyi Guo, Benyu Liu, Wei Ge, Min Zhu, Chip-Hong Chang.
https://ieeexplore.ieee.org/abstract/document/8487347/

REF-1183

Machine Learning Assisted PUF Calibration for Trustworthy Proof of Sensor Data in IoT
Urbi Chatterjee, Soumi Chatterjee, Debdeep Mukhopadhyay, Rajat Subhra Chakraborty.
https://dl.acm.org/doi/abs/10.1145/3393628

Einreichung

Name	Organisation	Datum	Veröffentlichungsdatum	Version
Paul A. Wortman	Wells Fargo	2020-10-23 +00:00	2021-07-20 +00:00	4.5

Änderungen

Name	Organisation	Datum	Kommentar
CWE Content Team	MITRE	2022-04-28 +00:00	updated Relationships
CWE Content Team	MITRE	2022-06-28 +00:00	updated Relationships
CWE Content Team	MITRE	2022-10-13 +00:00	updated References, Related_Attack_Patterns
CWE Content Team	MITRE	2023-01-31 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Demonstrative_Examples, Description, Mapping_Notes, Modes_of_Introduction, References, Relationships

CWE-1351 Details

CWE-1351