What is CWE-1330: Remanent Data Readable after Memory Erase?+
CWE-1330: Remanent Data Readable after Memory Erase is a Common Weakness Enumeration (CWE) entry maintained by MITRE. Confidential information stored in memory circuits is readable or recoverable after being cleared or erased. Data remanence occurs when stored, memory content is not fully lost after a memory-clear or -erase operation. Confidential memory contents can still be readable through data remanence in the hardware. Data remanence can occur because of performance optimization or memory organization during 'clear' or 'erase' operations, like a design that allows the memory-organization metadata (e.g., file pointers) to be erased without erasing the actual memory content. To protect against this weakness, memory devices will often support different commands for optimized memory erase and explicit secure erase. Data remanence can also happen because of the physical properties of memory circuits in use. For example, static, random-access-memory (SRAM) and dynamic, random-access-memory (DRAM) data retention is based on the charge retained in the memory cell, which depends on factors such as power supply, refresh rates, and temperature. Other than explicit erase commands, self-encrypting, secure-memory devices can also support secure erase through cryptographic erase commands. In such designs, only the decryption keys for encrypted data stored on the device are erased. That is, the stored data are always remnant in the media after a cryptographic erase. However, only the encrypted data can be extracted. Thus, protection against data recovery in such designs relies on the strength of the encryption algorithm.
What are the security consequences of Remanent Data Readable after Memory Erase?+
If exploited, CWE-1330 (Remanent Data Readable after Memory Erase) it can compromise Confidentiality, leading to outcomes such as Modify Memory and Read Memory.
How do you prevent or mitigate Remanent Data Readable after Memory Erase?+
Recommended mitigations for CWE-1330 include: Support for secure-erase commands that apply multiple cycles of overwriting memory with known patterns and of erasing actual content. Support for cryptographic erase in self-encrypting, memory devices. External, physical tools to erase memory such as ultraviolet-rays-based erase of Electrically erasable, programmable, read-only memory (EEPROM). Physical destruction of media device. This is done for repurposed or scrapped devices that are no longer in use.
How is Remanent Data Readable after Memory Erase detected?+
CWE-1330 can be detected using Architecture or Design Review and Dynamic Analysis with Manual Results Interpretation. Combining automated tooling with manual review typically yields the best coverage.
Which programming languages are affected by Remanent Data Readable after Memory Erase?+
CWE-1330 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of Remanent Data Readable after Memory Erase?+
MITRE documents real CVEs mapped to CWE-1330, including CVE-2019-8575. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-1330 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.