Détail du CWE-1351

CWE-1351

Improper Handling of Hardware Behavior in Exceptionally Cold Environments
Incomplete
2021-07-20
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Notifications pour un CWE
Restez informé de toutes modifications pour un CWE spécifique.
Gestion des notifications

Nom: Improper Handling of Hardware Behavior in Exceptionally Cold Environments

A hardware device, or the firmware running on it, is missing or has incorrect protection features to maintain goals of security primitives when the device is cooled below standard operating temperatures.

Informations générales

Modes d'introduction

Architecture and Design
Implementation

Plateformes applicables

Langue

Class: Not Language-Specific (Undetermined)

Systèmes d’exploitation

Class: Not OS-Specific (Undetermined)

Architectures

Class: Embedded (Undetermined)
Class: Microcomputer (Undetermined)

Technologies

Class: System on Chip (Undetermined)

Conséquences courantes

Portée Impact Probabilité
Integrity
Authentication		Varies by Context, Unexpected State

Note: Consequences of this weakness are highly contextual.		Low

Mesures d’atténuation potentielles

Phases : Architecture and Design
The system should account for security primitive behavior when cooled outside standard temperatures.

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Modèles d'attaque associés

CAPEC-ID Nom du modèle d'attaque
CAPEC-624 Hardware Fault Injection
The adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient temperature extremes, and more. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information.
CAPEC-625 Mobile Device Fault Injection
Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.

Références

REF-1181

Low-Temperature Data Remnanence Attacks Against Intrinsic SRAM PUFs
Nikolaos Athanasios Anagnostopoulos, Tolga Arul, Markus Rosenstihl, André Schaller, Sebastian Gabmeyer, Stefan Katzenbeisser.
https://ieeexplore.ieee.org/abstract/document/8491873/

REF-1182

A Fully Digital Physical Unclonable Function Based Temperature Sensor for Secure Remote Sensing
Yuan Cao, Yunyi Guo, Benyu Liu, Wei Ge, Min Zhu, Chip-Hong Chang.
https://ieeexplore.ieee.org/abstract/document/8487347/

REF-1183

Machine Learning Assisted PUF Calibration for Trustworthy Proof of Sensor Data in IoT
Urbi Chatterjee, Soumi Chatterjee, Debdeep Mukhopadhyay, Rajat Subhra Chakraborty.
https://dl.acm.org/doi/abs/10.1145/3393628

Soumission

Nom Organisation Date Date de publication Version
Paul A. Wortman Wells Fargo 2020-10-23 +00:00 2021-07-20 +00:00 4.5

Modifications

Nom Organisation Date Commentaire
CWE Content Team MITRE 2022-04-28 +00:00 updated Relationships
CWE Content Team MITRE 2022-06-28 +00:00 updated Relationships
CWE Content Team MITRE 2022-10-13 +00:00 updated References, Related_Attack_Patterns
CWE Content Team MITRE 2023-01-31 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-12-11 +00:00 updated Weakness_Ordinalities
Les informations affichées sur CVE Find proviennent de plusieurs sources de référence rigoureusement sélectionnées. Les données CVE sont fournies par MITRE Corporation et la National Vulnerability Database (NVD). Le catalogue des vulnérabilités activement exploitées (KEV) provient de la Cybersecurity and Infrastructure Security Agency (CISA), tandis que les scores EPSS sont issus de FIRST.org. Enfin, les données relatives aux faiblesses logicielles (CWE) et aux schémas d'attaque courants (CAPEC) sont maintenues par MITRE Corporation, et les informations sur les configurations logicielles et matérielles (CPE) proviennent du NVD.