CWE-1268 describes hardware enforced access control that fails to account for differences between control and write policies. It affects chip and firmware designers who protect device configuration and encryption keys with layered policies.
How it happens
Hardware engines often expose resources such as device configuration or encryption keys that belong to trusted firmware, usually set by a BIOS or bootloader. Hardware limits access using a policy that says which agent may do what.
With several policy levels, a control policy can allow direct access to a resource and also allow changes to the policies themselves. The trouble starts when an agent is in a resource's control policy but not in its write policy. That agent may be able to insert itself into the write policy register. Once there, it can write to resources it was never meant to touch.
What an attacker gains
MITRE lists leaked information, leaked encryption keys and modified device configuration. The recorded consequences also include code execution, privilege gain, protection bypass and crashes, all rated high.
How to find it
No detection methods are recorded. A design review can check each protected resource and compare its control policy membership with its write policy membership. Any agent present in one and absent from the other deserves an explanation.
How to fix it
- Define, per resource, which agents may change the policy itself.
- Make control and write policy membership consistent, or make the difference deliberate and documented.
- Test from an untrusted agent that attempts to add itself to the write policy and confirm the attempt fails.
Quick check
What is the core mistake?
An agent has influence over a policy register through the control policy without being authorized by the write policy, so it can grant itself write access.
