CWE-1268: Policy Privileges are not Assigned Consistently Between Control and Data Agents

How it's found

Policy Privileges are not Assigned Consistently Between Control and Data Agents is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.

Integrated circuits and hardware engines may provide access to resources (device-configuration, encryption keys, etc.) belonging to trusted firmware or software modules (commonly set by a BIOS or a bootloader). These accesses are typically controlled and limited by the hardware. Hardware design access control is sometimes implemented using a policy. A policy defines which entity or agent may or may not be allowed to perform an action. When a system implements multiple levels of policies, a control policy may allow direct access to a resource as well as changes to the policies themselves. Resources that include agents in their control policy but not in their write policy could unintentionally allow an untrusted agent to insert itself in the write policy register. Inclusion in the write policy register could allow a malicious or misbehaving agent write access to resources. This action could result in security compromises including leaked information, leaked encryption keys, or modification of device configuration.

Vulnerable vs. safe

Register

Field description

AES_KEY_CONTROL_POLICY

Controls which agents can write to READ_POLICY and WRITE_POLICY registers[31:0] Default 0x00000018

AES_KEY_READ_POLICY

Controls which agents can read the AES-key registers[31:0] Default 0x00000002

AES_KEY_WRITE_POLICY

Controls which agents can write to the AES-key registers[31:0] Default 0x00000004

Register

Field description

AES_KEY_CONTROL_POLICY

[31:0] Default 0x00000010

AES_KEY_READ_POLICY

[31:0] Default 0x00000002

AES_KEY_WRITE_POLICY

[31:0] Default 0x00000004

Consequences

• Modify Memory, Read Memory, DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Read Files or Directories, Reduce Reliability

Mitigations

• Architecture and Design/Implementation: Access-control-policy definition and programming flow must be sufficiently tested in pre-silicon and post-silicon testing.

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Base weakness
  CWE-266: Incorrect Privilege Assignment