CWE-1242: Inclusion of Undocumented Features or Chicken Bits
The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.
View on MITREExtended Description
A common design practice is to use undocumented bits on a device that can be used to disable certain functional security features. These bits are commonly referred to as "chicken bits". They can facilitate quick identification and isolation of faulty components, features that negatively affect performance, or features that do not provide the required controllability for debug and test. Another way to achieve this is through implementation of undocumented features. An attacker might exploit these interfaces for unauthorized access.
Technical Details
- Structure
- Simple
Applicable To
Security Consequences
Scope
Impact
Mitigation Strategies
Phase
Description
The implementation of chicken bits in a released product is highly discouraged. If implemented at all, ensure that they are disabled in production devices. All interfaces to a device should be documented.
Effectiveness
HighDetection Methods
No detection method information available for this CWE.
Code Examples & CVEs
Demonstrative Examples
Consider a device that comes with various security measures, such as secure boot. The secure-boot process performs firmware-integrity verification at boot time, and this code is stored in a separate SPI-flash device. However, this code contains undocumented "special access features" intended to be used only for performing failure analysis and intended to only be unlocked by the device designer.
Remove all chicken bits and hidden features that are exposed to attackers. Add authorization schemes that rely on cryptographic primitives to access any features that the manufacturer does not want to expose. Clearly document all interfaces.
CWE Relationships
No relationship information available for this CWE.
Frequently Asked Questions
What is CWE-1242: Inclusion of Undocumented Features or Chicken Bits?+
CWE-1242: Inclusion of Undocumented Features or Chicken Bits is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The device includes chicken bits or undocumented features that can create entry points for unauthorized actors. A common design practice is to use undocumented bits on a device that can be used to disable certain functional security features. These bits are commonly referred to as "chicken bits". They can facilitate quick identification and isolation of faulty components, features that negatively affect performance, or features that do not provide the required controllability for debug and test. Another way to achieve this is through implementation of undocumented features. An attacker might exploit these interfaces for unauthorized access.
What are the security consequences of Inclusion of Undocumented Features or Chicken Bits?+
If exploited, CWE-1242 (Inclusion of Undocumented Features or Chicken Bits) it can compromise Confidentiality, Integrity, Availability and Access Control, leading to outcomes such as Modify Memory, Read Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity and Bypass Protection Mechanism.
How do you prevent or mitigate Inclusion of Undocumented Features or Chicken Bits?+
Recommended mitigations for CWE-1242 include: The implementation of chicken bits in a released product is highly discouraged. If implemented at all, ensure that they are disabled in production devices. All interfaces to a device should be documented.
Which programming languages are affected by Inclusion of Undocumented Features or Chicken Bits?+
CWE-1242 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-1242 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.