CWE-1220 covers access controls that exist but are too coarse. The product uses a policy to restrict reads or writes to assets from untrusted agents, yet the policy lacks the granularity required, so it also allows access from agents that should have been blocked.
The MITRE write up is hardware oriented, but the observed examples are software, so the idea travels well.
How it happens
In integrated circuits and hardware engines, assets such as device configuration and keys are exposed to trusted firmware or software, commonly set by the BIOS or bootloader. After a power reset the hardware starts with default register values, and boot firmware then configures the protection.
A common flaw is a policy that is not fine grained enough. One rule covers a large region or a whole class of agents, so agents beyond the trusted ones can reach the asset. The result can be a loss of functionality or an inability to set up the device securely, and the risks run from leaked key material to modified device configuration.
The record lists two software cases:
- CVE-2022-24985: a form hosting website checked session authentication status for a single form only, which made it possible to bypass authentication when there were multiple forms.
- CVE-2021-36934: an operating system had an overly permissive access control list on some system files, including files related to user passwords.
Both are the same mistake. The control exists, but it covers less, or allows more, than the design intended.
What an attacker gains
MITRE rates the impact high across confidentiality, integrity and availability. Listed effects include reading and modifying memory, executing unauthorized code or commands, gaining privileges or assuming an identity, and bypassing a protection mechanism.
How to find it
The record lists no detection methods, but its mitigation implies a review approach. Check each protected asset and ask which agents can actually reach it under the current policy. Then compare that set to the set that should.
For software, test authorization per resource and not per session. If a user can reach one form, object or file, try the neighbors.
How to fix it
MITRE's mitigation, rated high effectiveness, spans design, implementation and testing:
- Review access control policy protections for design inconsistency and common weaknesses.
- Test the policy definition and programming flow in pre-silicon and post-silicon testing for hardware.
- In software, check authorization on every resource, and apply the narrowest permission that works.
Quick check
What does insufficient granularity mean?
The access control policy is too broad, so it allows access from agents that should have been blocked.
How did the form hosting CVE fit the pattern?
Authentication was checked for only one form, so with several forms the check did not cover them all.
