CWE-1272 describes a product that changes power or debug state without clearing information that should no longer be accessible after the change. It matters to hardware and firmware teams, and to anyone building devices that sleep or expose debug ports.
How it happens
Devices use many power and sleep states in normal operation: normal power, additional power, low power, hibernate and deep sleep. A device can also run in a debug condition. Moving from one state to another can change what information may be visible. If data that was fine to hold in the old state is still present in the new one, sensitive information can leak.
One recorded example is CVE-2020-12926. Product software did not set a flag required by TPM specifications, so a failed authorization attempt was not recorded after a loss of power.
What an attacker gains
The record rates impact high. Reading memory and application data can expose information that unlocks additional capabilities or hidden functionality of the device.
How to find it
MITRE gives a manual test worth copying.
- Write a known pattern into each sensitive location.
- Enter the power or debug state in question.
- Read the data back from the sensitive locations.
- If the reads succeed and return the pattern, the test fails and the device needs fixing.
How to fix it
The record lists no mitigations. The definition suggests a clear rule: list every transition between power and debug states, decide which data must not survive each one, and clear it before the transition completes. Re-run the pattern test whenever a state is added.
Quick check
What does a failing test look like?
You wrote a pattern to a sensitive location, changed state, and read the same pattern back.
