2052
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Technology : Web Based (Prevalence = Undetermined)
Alternate Terms
Ghost in the Shell :
Common Consequences
Scope Impact Likelihood
Access Control Varies by Context
Accountability Hide Activities
CWE Version 4.14
CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared
State
CWE-1250: Improper Preservation of Consistency
Between Independent Representations of Shared State 2052
Scope Impact Likelihood
Other Unexpected State
Potential Mitigations
Phase: Architecture and Design
Ensure that the admin tool refreshes its model of the underlying OS on a regular basis, and note
any inconsistencies with configuration files or other data sources that are expected to have the
same data.
Demonstrative Examples
Example 1:
Suppose that an attacker successfully gains root privileges on a Linux system and adds a new
'user2' account:
Example Language: Other (Attack)
echo "user2:x:0:0::/root:/" >> /etc/passwd;
echo "user2:\$6\$IdvyrM6VJnG8Su5U\$1gmW3Nm.IO4vxTQDQ1C8urm72JCadOHZQwqiH/
nRtL8dPY80xS4Ovsv5bPCMWnXKKWwmsocSWXupUf17LB3oS.:17256:0:99999:7:::" >> /etc/shadow;
This new user2 account would not be noticed on the web interface, if the interface does not refresh
its data of available users.
It could be argued that for this specific example, an attacker with root privileges would be likely to
compromise the admin tool or otherwise feed it with false data. However, this example shows how
the discrepancy in critical data can help attackers to escape detection.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1415 Comprehensive Categorization: Resource Control 1400 2544
References
[REF-1070]Tony Martin. "Ghost in the Shell Weakness". 2020 February 3. < https://
friendsglobal.com/ghost-in-the-shell/ghost-in-the-shell-weakness/ >.2023-04-07.
CWE-1250: Improper Preservation of Consistency Between Independent
Representations of Shared State
Weakness ID : 1250
Structure : Simple
Abstraction : Base
Description
The product has or supports multiple distributed components or sub-systems that are each required
to keep their own local copy of shared data - such as state or cache - but the product does not
ensure that all local copies remain consistent with each other.
Extended Description
In highly distributed environments, or on systems with distinct physical components that operate
independently, there is often a need for each component to store and update its own local copy of
key data such as state or cache, so that all components have the same "view" of the overall system
CWE Version 4.14
CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared
State
CWE-1250: Improper Preservation of Consistency
Between Independent Representations of Shared State