CWE-1280: Access Control Check Implemented After Asset is Accessed

How it's found

Access Control Check Implemented After Asset is Accessed is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.

The product implements a hardware-based access control check. The asset should be accessible only after the check is successful. If, however, this operation is not atomic and the asset is accessed before the check is complete, the security of the system may be compromised.

Vulnerable vs. safe

data_out = 0;

data_out = (grant_access) ? data_in : data_out;assign grant_access = (usr_id == 3'h4) ? 1'b1 : 1'b0;if (!rst_n)elsemodule foo_bar(data_out, usr_id, data_in, clk, rst_n);output reg [7:0] data_out;input wire [2:0] usr_id;input wire [7:0] data_in;input wire clk, rst_n;wire grant_access;always @ (posedge clk or negedge rst_n)beginendendmodule

data_out = 0;

assign grant_access = (usr_id == 3'h4) ? 1'b1 : 1'b0;data_out = (grant_access) ? data_in : data_out;if (!rst_n)elsealways @ (posedge clk or negedge rst_n)beginendendmodule

Consequences

• Modify Memory, Read Memory, Modify Application Data, Read Application Data, Gain Privileges or Assume Identity, Bypass Protection Mechanism

Mitigations

• Implementation: Implement the access control check first. Access should only be given to asset if agent is authorized.

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Class weakness
  CWE-696: Incorrect Behavior Order
• Pillar weakness
  CWE-284: Improper Access Control