Improper Isolation or Compartmentalization

Opis

The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

When a weakness occurs in functionality that is accessible by lower-privileged users, then without strong boundaries, an attack might extend the scope of the damage to higher-privileged users.

Inne nazwy

Separation of Privilege

Some people and publications use the term "Separation of Privilege" to describe this weakness, but this term has dual meanings in current usage. This node conflicts with the original definition of "Separation of Privilege" by Saltzer and Schroeder; that original definition is more closely associated with CWE-654. Because there are multiple interpretations, use of the "Separation of Privilege" term is discouraged.

Skutki

• Access Control

  Gain Privileges or Assume Identity; Bypass Protection Mechanism

  The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles.

Zapobieganie

• Architecture and Design

  Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.

Przykłady podatności

• CVE-2021-33096 Improper isolation of shared resource in a network-on-chip leads to denial of service
• CVE-2019-6260 Baseboard Management Controller (BMC) device implements Advanced High-performance Bus (AHB) bridges that do not require authentication for arbitrary read and write access to the BMC's physical address space from the host, and possibly the network [REF-1138].

Słabość nadrzędna

• CWE-657 Violation of Secure Design Principles
• CWE-693 Protection Mechanism Failure

Słabości podrzędne

• CWE-1189 Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
• CWE-1331 Improper Isolation of Shared Resources in Network On Chip (NoC)

Kiedy powstaje

• Architecture and Design — COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.
• Implementation

Dotyczy

Not Language-Specific

Uwagi

There is a close association with CWE-250 (Execution with Unnecessary Privileges). CWE-653 is about providing separate components for each "privilege"; CWE-250 is about ensuring that each component has the least amount of privileges possible. In this fashion, compartmentalization becomes one mechanism for reducing privileges.

The term "Separation of Privilege" is used in several different ways in the industry, but they generally combine two closely related principles: compartmentalization (this node) and using only one factor in a security decision (CWE-654). Proper compartmentalization implicitly introduces multiple factors into a security decision, but there can be cases in which multiple factors are required for authentication or other mechanisms that do not involve compartmentalization, such as performing all required checks on a submitted certificate. It is likely that CWE-653 and CWE-654 will provoke further discussion.

Źródła

1. The Protection of Information in Computer Systems — Jerome H. Saltzer, Michael D. Schroeder, Proceedings of the IEEE 63, 1975
2. Separation of Privilege — Sean Barnum, Michael Gegick, 2005
3. CVE-2019-6260: Gaining control of BMC from the host processor — Stewart Smith, 2019
4. State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation — Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy, 2014