Détail du CWE-1330

Confidential information stored in memory circuits is readable or recoverable after being cleared or erased.

Data remanence occurs when stored, memory content is not fully lost after a memory-clear or -erase operation. Confidential memory contents can still be readable through data remanence in the hardware.

Data remanence can occur because of performance optimization or memory organization during 'clear' or 'erase' operations, like a design that allows the memory-organization metadata (e.g., file pointers) to be erased without erasing the actual memory content. To protect against this weakness, memory devices will often support different commands for optimized memory erase and explicit secure erase.

Data remanence can also happen because of the physical properties of memory circuits in use. For example, static, random-access-memory (SRAM) and dynamic, random-access-memory (DRAM) data retention is based on the charge retained in the memory cell, which depends on factors such as power supply, refresh rates, and temperature.

Other than explicit erase commands, self-encrypting, secure-memory devices can also support secure erase through cryptographic erase commands. In such designs, only the decryption keys for encrypted data stored on the device are erased. That is, the stored data are always remnant in the media after a cryptographic erase. However, only the encrypted data can be extracted. Thus, protection against data recovery in such designs relies on the strength of the encryption algorithm.

Modes d'introduction

Architecture and Design
Implementation

Plateformes applicables

Langue

Class: Not Language-Specific (Undetermined)

Systèmes d’exploitation

Class: Not OS-Specific (Undetermined)

Architectures

Class: Not Architecture-Specific (Undetermined)

Technologies

Name: Security Hardware (Undetermined)
Class: Not Technology-Specific (Undetermined)

Conséquences courantes

Exemples observés

Mesures d’atténuation potentielles

Phases : Architecture and Design

• Support for secure-erase commands that apply multiple cycles of overwriting memory with known patterns and of erasing actual content.
• Support for cryptographic erase in self-encrypting, memory devices.
• External, physical tools to erase memory such as ultraviolet-rays-based erase of Electrically erasable, programmable, read-only memory (EEPROM).
• Physical destruction of media device. This is done for repurposed or scrapped devices that are no longer in use.

Méthodes de détection

Architecture or Design Review

• Testing of memory-device contents after clearing or erase commands.
• Dynamic analysis of memory contents during device operation to detect specific, confidential assets.
• Architecture and design analysis of memory clear and erase operations.

Dynamic Analysis with Manual Results Interpretation

• Testing of memory-device contents after clearing or erase commands.
• Dynamic analysis of memory contents during device operation to detect specific, confidential assets.
• Architecture and design analysis of memory clear and erase operations.

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Modèles d'attaque associés

Références

REF-1154

NIST Special Publication 800-88 Revision 1: Guidelines for Media Sanitization
National Institute of Standards and Technology.
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

Soumission

Modifications