CWE-224, Obscured Security-relevant Information by Alternate Name, applies when a product records security-relevant information under an alternate name of the affected entity, not its canonical name.
Files can have several names through hard links, symbolic links and similar aliases. If audit records use the alias, the log may not show which real object was touched.
How it happens
MITRE's observed example is CVE-2002-0725: an attacker performs malicious actions on a hard link to a file, which obscures the real target file. The record shows activity on the alias. A reviewer looking for access to the real file finds nothing.
What an attacker gains
MITRE lists non-repudiation, access control and hiding activities, along with gaining privileges or assuming identity. The attacker can act on a protected object while the record points somewhere harmless.
How to find it
MITRE lists no detection methods. Create an alias to a protected object, act on it, then check whether your audit trail shows the real object. Review any code that logs a path exactly as supplied by the caller.
How to fix it
MITRE gives no mitigations. The natural fix is to resolve names to their canonical form before checking permissions and before writing records, and to log both the supplied name and the resolved one.
import os
real = os.path.realpath(supplied_path)
log.info("open supplied=%s resolved=%s", supplied_path, real)
Note that hard links do not resolve to a single canonical path this way. Where hard links matter, record a stable identifier such as the device and inode as well.
Quick check
Why log the resolved name?
The supplied name is controlled by the caller. The resolved one tells you what was actually affected.
