CWE-1351 describes a device, or its firmware, that does not maintain its security primitives when cooled below standard operating temperatures.
How it happens
Designers may not anticipate how components behave in extreme cold. One change MITRE gives: power loss does not clear volatile state when the device is cooled below normal temperatures. That is a problem if a security decision relies on the starting state of volatile memory.
The example is a Physical Unclonable Function (PUF), a primitive that improves confidentiality, authenticity and integrity. Paired with DRAM, SRAM or another temperature sensitive entropy source, it can fail in the cold. When power is cycled at low temperature, the memory does not show the bit patterns caused by manufacturing differences. It holds the data from the previous boot instead. If the PUF output feeds a cryptographic construction that does not assume an adversary can control the seed data, the construction is weakened.
MITRE states that this weakness does not cover cold boot attacks, where RAM or external storage is super cooled and read externally.
What an attacker gains
Integrity and authentication effects and an unexpected state. MITRE says consequences are highly contextual.
How to find it
The record has no detection methods. Review each security primitive that uses a temperature sensitive entropy source, and ask what its output looks like at low temperature.
How to fix it
MITRE's mitigation is to account for security primitive behavior when the device is cooled outside standard temperatures, at design time.
Quick check
Is this the same as a cold boot attack?
No. MITRE explicitly excludes cold boot attacks, where memory is cooled and read externally.
