1993
The product implements access controls via a policy or other feature with the intention to disable
or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However,
implemented access controls lack required granularity, which renders the control policy too broad
because it allows accesses from unauthorized agents to the security-sensitive assets.
Extended Description
Integrated circuits and hardware engines can expose accesses to assets (device configuration,
keys, etc.) to trusted firmware or a software module (commonly set by BIOS/bootloader). This
access is typically access-controlled. Upon a power reset, the hardware or system usually starts
with default values in registers, and the trusted firmware (Boot firmware) configures the necessary
access-control protection.
A common weakness that can exist in such protection schemes is that access controls or policies
are not granular enough. This condition allows agents beyond trusted agents to access assets and
could lead to a loss of functionality or the ability to set up the device securely. This further results in
security risks from leaked, sensitive, key material to modification of device configuration.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
ParentOf 1222 Insufficient Granularity of Address Regions Protected by
Register Locks