{"@ID": "1268", "@Name": "Policy Privileges are not Assigned Consistently Between Control and Data Agents", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Draft", "Description": "The product's hardware-enforced access control for a particular resource improperly accounts for privilege discrepancies between control and write policies.", "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "266", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Operating_System": {"@Class": "Not OS-Specific", "@Prevalence": "Undetermined"}, "Architecture": {"@Class": "Not Architecture-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}}, "Background_Details": {"Background_Detail": {"xhtml:p": ["Integrated circuits and hardware engines may provide access to resources (device-configuration, encryption keys, etc.) belonging to trusted firmware or software modules (commonly set by a BIOS or a bootloader). These accesses are typically controlled and limited by the hardware.", "Hardware design access control is sometimes implemented using a policy. A policy defines which entity or agent may or may not be allowed to perform an action. When a system implements multiple levels of policies, a control policy may allow direct access to a resource as well as changes to the policies themselves."], "#text_blocks": ["Integrated circuits and hardware engines may provide access to resources (device-configuration, encryption keys, etc.) belonging to trusted firmware or software modules (commonly set by a BIOS or a bootloader). These accesses are typically controlled and limited by the hardware.", "Hardware design access control is sometimes implemented using a policy. A policy defines which entity or agent may or may not be allowed to perform an action. When a system implements multiple levels of policies, a control policy may allow direct access to a resource as well as changes to the policies themselves."]}}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Architecture and Design", "Note": "This weakness may be introduced during the design of a device when the architect does not comprehensively specify all of the policies required by an agent."}, {"Phase": "Implementation", "Note": "This weakness may be introduced during implementation if device policy restrictions do not sufficiently constrain less-privileged clients."}]}, "Common_Consequences": {"Consequence": {"Scope": ["Confidentiality", "Integrity", "Availability", "Access Control"], "Impact": ["Modify Memory", "Read Memory", "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Bypass Protection Mechanism", "Read Files or Directories", "Reduce Reliability"], "Likelihood": "High", "Note": {"xhtml:p": "Resources that include agents in their control policy but not in their write policy could unintentionally allow an untrusted agent to insert itself in the write policy register. Inclusion in the write policy register could allow a malicious or misbehaving agent write access to resources. This action could result in security compromises including leaked information, leaked encryption keys, or modification of device configuration.", "#text_blocks": ["Resources that include agents in their control policy but not in their write policy could unintentionally allow an untrusted agent to insert itself in the write policy register. Inclusion in the write policy register could allow a malicious or misbehaving agent write access to resources. This action could result in security compromises including leaked information, leaked encryption keys, or modification of device configuration."]}}}, "Potential_Mitigations": {"Mitigation": {"Phase": ["Architecture and Design", "Implementation"], "Description": "Access-control-policy definition and programming flow must be sufficiently tested in pre-silicon and post-silicon testing."}}, "Demonstrative_Examples": {"Demonstrative_Example": {"Intro_Text": {"xhtml:p": ["Consider a product that stores a 128-bit AES key in four 32-bit registers, collectively called the AES key registers.", "Three additional 32-bit registers are used to define the hardware enforced access control for the AES key registers. Collectively these registers are referred to as the AES Policy registers, and their functions are explained in the following table:"], "#text_blocks": ["Consider a product that stores a 128-bit AES key in four 32-bit registers, collectively called the AES key registers.", "Three additional 32-bit registers are used to define the hardware enforced access control for the AES key registers. Collectively these registers are referred to as the AES Policy registers, and their functions are explained in the following table:"]}, "Example_Code": [{"@Nature": "Informative", "xhtml:table": {"xhtml:caption": "AES Policy Registers", "xhtml:tr": [{"xhtml:th": ["Register", "Permission granted"]}, {"xhtml:td": ["AES_KEY_CONTROL_POLICY", "Defines which agents can write to both AES_KEY_READ_POLICY and AES_KEY_WRITE_POLICY registers."]}, {"xhtml:td": ["AES_KEY_READ_POLICY", "Defines which agents can read the AES key registers."]}, {"xhtml:td": ["AES_KEY_WRITE_POLICY", "Defines which agents can write the AES key registers."]}]}, "#text_blocks": ["AES Policy Registers\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tRegister\n\t\t\t\t\t\t\t\tPermission granted\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAES_KEY_CONTROL_POLICY\n\t\t\t\t\t\t\t\tDefines which agents can write to both AES_KEY_READ_POLICY and AES_KEY_WRITE_POLICY registers.\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAES_KEY_READ_POLICY\n\t\t\t\t\t\t\t\tDefines which agents can read the AES key registers.\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAES_KEY_WRITE_POLICY\n\t\t\t\t\t\t\t\tDefines which agents can write the AES key registers."]}, {"@Nature": "Bad", "@Language": "Other", "xhtml:table": {"xhtml:tr": [{"xhtml:th": ["Register", "Initial value (hexadecimal)", "Bits 3 2 1 0 (binary)", "Agents granted permission"]}, {"xhtml:td": ["AES_KEY_READ_POLICY", "0x00000001", "0001b", "Agent 0"]}, {"xhtml:td": ["AES_KEY_WRITE_POLICY", "0x00000002", "0010b", "Agent 1"]}, {"xhtml:td": ["AES_KEY_CONTROL_POLICY", "0x0000000C", "1100b", "Agents 2 and 3"]}]}, "#text_blocks": ["Register\n\t\t\t\t\t\t\t\tInitial value (hexadecimal)\n\t\t\t\t\t\t\t\tBits 3 2 1 0 (binary)\n\t\t\t\t\t\t\t\tAgents granted permission\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAES_KEY_READ_POLICY\n\t\t\t\t\t\t\t\t0x00000001\n\t\t\t\t\t\t\t\t0001b\n\t\t\t\t\t\t\t\tAgent 0\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAES_KEY_WRITE_POLICY\n\t\t\t\t\t\t\t\t0x00000002\n\t\t\t\t\t\t\t\t0010b\n\t\t\t\t\t\t\t\tAgent 1\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAES_KEY_CONTROL_POLICY\n\t\t\t\t\t\t\t\t0x0000000C\n\t\t\t\t\t\t\t\t1100b\n\t\t\t\t\t\t\t\tAgents 2 and 3"]}, {"@Nature": "Informative", "xhtml:table": {"xhtml:tr": [{"xhtml:th": ["Agent", "Read AES key", "Write AES key", "Modify AES key access policies"]}, {"xhtml:td": ["Agent 0", "Allowed", "Not Allowed", "Not Allowed"]}, {"xhtml:td": ["Agent 1", "Not Allowed", "Allowed", "Not Allowed"]}, {"xhtml:td": ["Agent 2 (untrusted)", "Not Allowed", "Not Allowed", "Allowed"]}, {"xhtml:td": ["Agent 3", "Not Allowed", "Not Allowed", "Allowed"]}]}, "#text_blocks": ["Agent\n\t\t\t\t\t\t\t\tRead AES key\n\t\t\t\t\t\t\t\tWrite AES key\n\t\t\t\t\t\t\t\tModify AES key access policies\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAgent 0\n\t\t\t\t\t\t\t\tAllowed\n\t\t\t\t\t\t\t\tNot Allowed\n\t\t\t\t\t\t\t\tNot Allowed\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAgent 1\n\t\t\t\t\t\t\t\tNot Allowed\n\t\t\t\t\t\t\t\tAllowed\n\t\t\t\t\t\t\t\tNot Allowed\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAgent 2 (untrusted)\n\t\t\t\t\t\t\t\tNot Allowed\n\t\t\t\t\t\t\t\tNot Allowed\n\t\t\t\t\t\t\t\tAllowed\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAgent 3\n\t\t\t\t\t\t\t\tNot Allowed\n\t\t\t\t\t\t\t\tNot Allowed\n\t\t\t\t\t\t\t\tAllowed"]}, {"@Nature": "Good", "@Language": "Other", "xhtml:table": {"xhtml:tr": [{"xhtml:th": ["Register", "Initial value (hexadecimal)", "Bits 3 2 1 0 (binary)", "Agents granted permission"]}, {"xhtml:td": ["AES_KEY_READ_POLICY", "0x00000001", "0001b", "Agent 0"]}, {"xhtml:td": ["AES_KEY_WRITE_POLICY", "0x00000002", "0010b", "Agent 1"]}, {"xhtml:td": ["AES_KEY_CONTROL_POLICY", "0x00000008", "1000b", "Agent 3"]}]}, "#text_blocks": ["Register\n\t\t\t\t\t\t\t\tInitial value (hexadecimal)\n\t\t\t\t\t\t\t\tBits 3 2 1 0 (binary)\n\t\t\t\t\t\t\t\tAgents granted permission\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAES_KEY_READ_POLICY\n\t\t\t\t\t\t\t\t0x00000001\n\t\t\t\t\t\t\t\t0001b\n\t\t\t\t\t\t\t\tAgent 0\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAES_KEY_WRITE_POLICY\n\t\t\t\t\t\t\t\t0x00000002\n\t\t\t\t\t\t\t\t0010b\n\t\t\t\t\t\t\t\tAgent 1\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tAES_KEY_CONTROL_POLICY\n\t\t\t\t\t\t\t\t0x00000008\n\t\t\t\t\t\t\t\t1000b\n\t\t\t\t\t\t\t\tAgent 3"]}], "Body_Text": [{"xhtml:p": ["Each AES policy register uses one bit per agent to specify whether that agent has the permission defined by the register. Bit 0 corresponds to Agent 0, bit 1 to Agent 1, and so on. A value of 1 grants permission; 0 denies it. For example, setting bit 0 of AES_KEY_READ_POLICY to 1 allows Agent 0 to read the AES key registers.", "The following initial configuration for the AES policy registers illustrates these permissions for four agents, numbered 0 through 3. The table shows only bits 3 through 0, with bit 0 on the right. All higher bits are 0."], "#text_blocks": ["Each AES policy register uses one bit per agent to specify whether that agent has the permission defined by the register. Bit 0 corresponds to Agent 0, bit 1 to Agent 1, and so on. A value of 1 grants permission; 0 denies it. For example, setting bit 0 of AES_KEY_READ_POLICY to 1 allows Agent 0 to read the AES key registers.", "The following initial configuration for the AES policy registers illustrates these permissions for four agents, numbered 0 through 3. The table shows only bits 3 through 0, with bit 0 on the right. All higher bits are 0."]}, {"xhtml:p": "Agents 0, 1, and 3 are trusted. Agent 2 is untrusted and should not have access to the AES key or its access policies. The initial values of the three AES policy registers shown above result in the permissions summarized below.", "#text_blocks": ["Agents 0, 1, and 3 are trusted. Agent 2 is untrusted and should not have access to the AES key or its access policies. The initial values of the three AES policy registers shown above result in the permissions summarized below."]}, {"xhtml:p": ["The initial configuration denies untrusted Agent 2 direct access to the AES key but allows it to modify the policies that enforce this restriction.", "For example, Agent 2 can change AES_KEY_WRITE_POLICY from its initial value of 0x00000002 (0010b) to 0x00000006 (0110b). This sets bit 2 while preserving bit 1, granting Agent 2 write access to the AES key registers while retaining Agent 1\u2019s write access.", "To prevent this, grant permission to modify the access policies only to agents trusted to manage access to the key. Setting the initial value of AES_KEY_CONTROL_POLICY to 0x00000008 (1000b) allows only trusted Agent 3 to write to AES_KEY_READ_POLICY and AES_KEY_WRITE_POLICY. Untrusted Agent 2 can no longer modify either policy to grant itself access to the AES key registers. The initial policy register values should therefore be as follows:"], "#text_blocks": ["The initial configuration denies untrusted Agent 2 direct access to the AES key but allows it to modify the policies that enforce this restriction.", "For example, Agent 2 can change AES_KEY_WRITE_POLICY from its initial value of 0x00000002 (0010b) to 0x00000006 (0110b). This sets bit 2 while preserving bit 1, granting Agent 2 write access to the AES key registers while retaining Agent 1\u2019s write access.", "To prevent this, grant permission to modify the access policies only to agents trusted to manage access to the key. Setting the initial value of AES_KEY_CONTROL_POLICY to 0x00000008 (1000b) allows only trusted Agent 3 to write to AES_KEY_READ_POLICY and AES_KEY_WRITE_POLICY. Untrusted Agent 2 can no longer modify either policy to grant itself access to the AES key registers. The initial policy register values should therefore be as follows:"]}]}}, "Related_Attack_Patterns": {"Related_Attack_Pattern": {"@CAPEC_ID": "180"}}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Notes": {"Note": {"@Type": "Maintenance", "#text": "This entry is still under development and will continue to see updates and content improvements."}}, "Content_History": {"Submission": {"Submission_Name": "Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi", "Submission_Organization": "Intel Corporation", "Submission_Date": "2020-02-12", "Submission_Version": "4.1", "Submission_ReleaseDate": "2020-02-24"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-08-20", "Modification_Version": "4.2", "Modification_ReleaseDate": "2020-08-20", "Modification_Comment": "updated Demonstrative_Examples, Description, Modes_of_Introduction, Name, Potential_Mitigations, Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-04-28", "Modification_Version": "4.7", "Modification_ReleaseDate": "2022-04-28", "Modification_Comment": "updated Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-10-13", "Modification_Version": "4.9", "Modification_ReleaseDate": "2022-10-13", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Demonstrative_Examples, Relationships, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-04-30", "Modification_Version": "4.20", "Modification_ReleaseDate": "2026-04-30", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Background_Details, Common_Consequences, Demonstrative_Examples, Description"}], "Contribution": {"@Type": "Feedback", "Contribution_Name": "Jagadish Nayak", "Contribution_Organization": "Cycuity", "Contribution_Date": "2025-10-09", "Contribution_Version": "4.20", "Contribution_ReleaseDate": "2026-04-30", "Contribution_Comment": "Reported an incorrect value for Agent 3 in the demonstrative example, and suggested an alternative."}, "Previous_Entry_Name": {"@Date": "2020-08-20", "#text": "Agents Included in Control Policy are not Contained in Less-Privileged Policy"}}, "entry_type": "Weakness"}