CWE-1351 Detail

CWE-1351

Improper Handling of Hardware Behavior in Exceptionally Cold Environments
Incomplete
2021-07-20
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Meldingen voor een CWE
Blijf op de hoogte van wijzigingen voor een specifieke CWE.
Meldingen beheren

Naam: Improper Handling of Hardware Behavior in Exceptionally Cold Environments

A hardware device, or the firmware running on it, is missing or has incorrect protection features to maintain goals of security primitives when the device is cooled below standard operating temperatures.

Algemene informatie

Introductiemodi

Architecture and Design
Implementation

Toepasselijke platforms

Taal

Class: Not Language-Specific (Undetermined)

Besturingssystemen

Class: Not OS-Specific (Undetermined)

Architecturen

Class: Embedded (Undetermined)
Class: Microcomputer (Undetermined)

Technologieën

Class: System on Chip (Undetermined)

Veelvoorkomende gevolgen

Bereik Impact Waarschijnlijkheid
Integrity
Authentication		Varies by Context, Unexpected State

Note: Consequences of this weakness are highly contextual.		Low

Mogelijke risicobeperkingen

Phases : Architecture and Design
The system should account for security primitive behavior when cooled outside standard temperatures.

Notities kwetsbaarheidsmapping

Rechtvaardiging : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Opmerking : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Gerelateerde aanvalspatronen

CAPEC-ID Naam aanvalspatroon
CAPEC-624 Hardware Fault Injection
The adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient temperature extremes, and more. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information.
CAPEC-625 Mobile Device Fault Injection
Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.

Referenties

REF-1181

Low-Temperature Data Remnanence Attacks Against Intrinsic SRAM PUFs
Nikolaos Athanasios Anagnostopoulos, Tolga Arul, Markus Rosenstihl, André Schaller, Sebastian Gabmeyer, Stefan Katzenbeisser.
https://ieeexplore.ieee.org/abstract/document/8491873/

REF-1182

A Fully Digital Physical Unclonable Function Based Temperature Sensor for Secure Remote Sensing
Yuan Cao, Yunyi Guo, Benyu Liu, Wei Ge, Min Zhu, Chip-Hong Chang.
https://ieeexplore.ieee.org/abstract/document/8487347/

REF-1183

Machine Learning Assisted PUF Calibration for Trustworthy Proof of Sensor Data in IoT
Urbi Chatterjee, Soumi Chatterjee, Debdeep Mukhopadhyay, Rajat Subhra Chakraborty.
https://dl.acm.org/doi/abs/10.1145/3393628

Indiening

Naam Organisatie Datum Releasedatum Version
Paul A. Wortman Wells Fargo 2020-10-23 +00:00 2021-07-20 +00:00 4.5

Wijzigingen

Naam Organisatie Datum Opmerking
CWE Content Team MITRE 2022-04-28 +00:00 updated Relationships
CWE Content Team MITRE 2022-06-28 +00:00 updated Relationships
CWE Content Team MITRE 2022-10-13 +00:00 updated References, Related_Attack_Patterns
CWE Content Team MITRE 2023-01-31 +00:00 updated Related_Attack_Patterns
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-12-11 +00:00 updated Weakness_Ordinalities
De informatie die op CVE Find wordt gepresenteerd, is afkomstig van verschillende zorgvuldig geselecteerde referentiebronnen. CVE-gegevens worden geleverd door MITRE Corporation en de National Vulnerability Database (NVD). De Known Exploited Vulnerabilities (KEV)-catalogus is afkomstig van de Cybersecurity and Infrastructure Security Agency (CISA), terwijl EPSS-scores afkomstig zijn van FIRST.org. Daarnaast worden gegevens over softwarezwakheden (CWE) en veelvoorkomende aanvalspatronen (CAPEC) bijgehouden door MITRE Corporation, en informatie over hardware- en softwareconfiguraties (CPE) wordt geleverd door de NVD.