CWE-1351
Weakness Allowed-with-ReviewImproper Handling of Hardware Behavior in Exceptionally Cold Environments
Abstraction: Base · Status: Incomplete
The hardware device, or the firmware running on it, is missing or has incorrect protection mechanisms to maintain goals of security primitives when the device is cooled below standard operating temperatures.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
This weakness does not cover "Cold Boot Attacks" wherein RAM or other external storage is super-cooled and read externally by an attacker.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
The hardware designer may improperly anticipate hardware behavior when exposed to exceptionally cold conditions. As a result, they may introduce a weakness by not accounting for the modified behavior of critical components when in extreme environments.
Content history
updated Relationships
updated Relationships
updated References, Related_Attack_Patterns
updated Related_Attack_Patterns
updated Relationships
updated Mapping_Notes
updated Weakness_Ordinalities
updated Common_Consequences, Demonstrative_Examples, Description, Mapping_Notes, Modes_of_Introduction, References, Relationships
0 vulnerabilities reference this CWE, most recent first.
No vulnerabilities reference this CWE.
Mitigation
The system should account for security primitive behavior when cooled outside standard temperatures.
CAPEC-624: Hardware Fault Injection
The adversary uses disruptive signals or events, or alters the physical environment a device operates in, to cause faulty behavior in electronic devices. This can include electromagnetic pulses, laser pulses, clock glitches, ambient temperature extremes, and more. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information.
CAPEC-625: Mobile Device Fault Injection
Fault injection attacks against mobile devices use disruptive signals or events (e.g. electromagnetic pulses, laser pulses, clock glitches, etc.) to cause faulty behavior. When performed in a controlled manner on devices performing cryptographic operations, this faulty behavior can be exploited to derive secret key information. Although this attack usually requires physical control of the mobile device, it is non-destructive, and the device can be used after the attack without any indication that secret keys were compromised.