{"@ID": "1351", "@Name": "Improper Handling of Hardware Behavior in Exceptionally Cold Environments", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The hardware device, or the firmware running on it, is\n                missing or has incorrect protection mechanisms to maintain\n                goals of security primitives when the device is cooled below\n                standard operating temperatures.", "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "1384", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Operating_System": {"@Class": "Not OS-Specific", "@Prevalence": "Undetermined"}, "Architecture": [{"@Class": "Embedded", "@Prevalence": "Undetermined"}, {"@Class": "Microcomputer", "@Prevalence": "Undetermined"}], "Technology": {"@Class": "System on Chip", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Architecture and Design", "Note": {"xhtml:p": "The hardware designer may improperly anticipate\n                    hardware behavior when exposed to exceptionally cold\n                    conditions. As a result, they may introduce a weakness by not\n                    accounting for the modified behavior of critical components\n                    when in extreme environments.", "#text_blocks": ["The hardware designer may improperly anticipate\n                    hardware behavior when exposed to exceptionally cold\n                    conditions. As a result, they may introduce a weakness by not\n                    accounting for the modified behavior of critical components\n                    when in extreme environments."]}}, {"Phase": "Implementation"}]}, "Common_Consequences": {"Consequence": {"Scope": ["Integrity", "Authentication"], "Impact": ["Varies by Context", "Unexpected State"], "Likelihood": "Low", "Note": "This may result in a weakness when the\n\t\t\t\t\tstarting state of the volatile memory is being\n\t\t\t\t\trelied upon for a security decision. Consequences\n\t\t\t\t\tof this weakness are highly contextual."}}, "Potential_Mitigations": {"Mitigation": {"Phase": "Architecture and Design", "Description": "The system should account for security primitive behavior when cooled outside standard temperatures."}}, "Demonstrative_Examples": {"Demonstrative_Example": {"Intro_Text": "Consider a product in which power loss\n\t\t\t\tdoes not clear or reset any volatile state when cooled\n\t\t\t\tbelow standard operating temperatures. For example, a\n\t\t\t\tPhysical Unclonable Function (PUF) may be supplied as\n\t\t\t\ta security primitive to improve confidentiality,\n\t\t\t\tauthenticity, and integrity guarantees.", "Example_Code": {"@Nature": "Bad", "@Language": "Algorithm", "#text": "When the PUF is paired with DRAM, SRAM, or\n\t\t\t\t  another temperature-sensitive entropy source,\n\t\t\t\t  the system designer may introduce a weakness by\n\t\t\t\t  failing to account for the chosen entropy\n\t\t\t\t  source's behavior at exceptionally low\n\t\t\t\t  temperatures."}, "Body_Text": "In the case of DRAM and SRAM, when power is cycled\n\t\t\t\t  at low temperatures, the device will not contain the\n\t\t\t\t  bitwise biasing caused by inconsistencies in\n\t\t\t\t  manufacturing and will instead contain the data from\n\t\t\t\t  previous boot. Should the PUF primitive be used in a\n\t\t\t\t  cryptographic construction which does not account\n\t\t\t\t  for full adversary control of PUF seed data,\n\t\t\t\t  weakness would arise."}}, "Related_Attack_Patterns": {"Related_Attack_Pattern": [{"@CAPEC_ID": "624"}, {"@CAPEC_ID": "625"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-1181"}, {"@External_Reference_ID": "REF-1182"}, {"@External_Reference_ID": "REF-1183"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": {"xhtml:p": ["This weakness does not cover \"Cold Boot\n              Attacks\" wherein RAM or other external storage is\n              super-cooled and read externally by an\n              attacker.", "Carefully read both the name and description to ensure\n\t\t\t\tthat this mapping is an appropriate fit. Do not try to\n\t\t\t\t'force' a mapping to a lower-level Base/Variant simply\n\t\t\t\tto comply with this preferred level of abstraction."], "#text_blocks": ["This weakness does not cover \"Cold Boot\n              Attacks\" wherein RAM or other external storage is\n              super-cooled and read externally by an\n              attacker.", "Carefully read both the name and description to ensure\n\t\t\t\tthat this mapping is an appropriate fit. Do not try to\n\t\t\t\t'force' a mapping to a lower-level Base/Variant simply\n\t\t\t\tto comply with this preferred level of abstraction."]}, "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "Paul A. Wortman", "Submission_Organization": "Wells Fargo", "Submission_Date": "2020-10-23", "Submission_Version": "4.5", "Submission_ReleaseDate": "2021-07-20"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-04-28", "Modification_Version": "4.7", "Modification_ReleaseDate": "2022-04-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-06-28", "Modification_Version": "4.8", "Modification_ReleaseDate": "2022-06-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-10-13", "Modification_Version": "4.9", "Modification_ReleaseDate": "2022-10-13", "Modification_Comment": "updated References, Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Common_Consequences, Demonstrative_Examples, Description, Mapping_Notes, Modes_of_Introduction, References, Relationships"}]}, "entry_type": "Weakness"}