If a threat actor can physically access a RAM chip, they may be able to readout the contents of the chip. Multiple techniques can be used to extract the contents of RAM, including both runtime and physical access, such as the threat actor can use a Cold-boot attack to physically cool the RAM to minimize the decay of the electrical charge and then physically copy the contents of that RAM. Through these methods, critical data, including firmware or secrets (such as passwords and cryptographic keys), may therefore be vulnerable to extraction. Extraction of this information could then lead to reverse engineering to identify vulnerabilities, abusing secrets to gain unauthorized access, or subverting at-rest encryption schemes.

• CWE-311: Missing Encryption of Sensitive Data
• CWE-1384: Improper Handling of Physical or Environmental Conditions