CWE-1330, Remanent Data Readable after Memory Erase, means confidential information in memory circuits can still be read or recovered after it was cleared. It matters to anyone who resells, repurposes or scraps devices, and to teams building them.
How it happens
Data remanence has two broad sources.
The first is design for speed. A clear or erase may remove only the organizing metadata, such as file pointers, and leave the actual content in place. Memory devices often offer both an optimized erase and an explicit secure erase.
The second is physics. SRAM and DRAM hold data as charge in cells, and retention depends on power supply, refresh rates and temperature.
Self-encrypting devices can offer cryptographic erase, which removes only the decryption keys. The encrypted data stays on the media, so protection then depends on the strength of the encryption.
The record includes CVE-2019-8575: a base station factory reset might not delete all user information, which could let a new owner of a used device see the previous owner's data.
What an attacker gains
Confidential data becomes readable to an untrusted agent. Memory may also be modifiable.
How to find it
MITRE suggests testing memory device contents after clear or erase commands, dynamic analysis of memory contents during operation to detect specific confidential assets, and design analysis of clear and erase operations.
How to fix it
Options in the record:
- Secure erase commands that overwrite memory several times with known patterns and erase the actual content.
- Cryptographic erase on self-encrypting memory devices.
- External physical tools, such as ultraviolet erase for EEPROM.
- Physical destruction of the media for repurposed or scrapped devices.
Quick check
Does a factory reset prove data is gone?
Not by itself. The test is to examine memory contents after the erase, as the record suggests.
