CWE-653: Improper Isolation or Compartmentalization (Class)

Description: The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

Extended Description: When a weakness occurs in functionality that is accessible by lower-privileged users, then without strong boundaries, an attack might extend the scope of the damage to higher-privileged users.


Alternate Terms: ::TERM:Separation of Privilege:DESCRIPTION:Some people and publications use the term Separation of Privilege to describe this weakness, but this term has dual meanings in current usage. This node conflicts with the original definition of Separation of Privilege by Saltzer and Schroeder; that original definition is more closely associated with CWE-654. Because there are multiple interpretations, use of the Separation of Privilege term is discouraged.::

Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.::PHASE:Implementation::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:IMPACT:Bypass Protection Mechanism:NOTE:The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles.::

Detection Methods: ::METHOD:Automated Static Analysis - Binary or Bytecode:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Compare binary / bytecode to application permission manifest:EFFECTIVENESS:SOAR Partial::METHOD:Manual Static Analysis - Source Code:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused Manual Spotcheck - Focused manual analysis of source:EFFECTIVENESS:High::METHOD:Architecture or Design Review:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal Methods / Correct-By-Construction Cost effective for partial coverage: Attack Modeling:EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.::

Observed Examples: ::REFERENCE:CVE-2021-33096:DESCRIPTION:Improper isolation of shared resource in a network-on-chip leads to denial of service:LINK:https://www.cve.org/CVERecord?id=CVE-2021-33096::REFERENCE:CVE-2019-6260:DESCRIPTION:Baseboard Management Controller (BMC) device implements Advanced High-performance Bus (AHB) bridges that do not require authentication for arbitrary read and write access to the BMC's physical address space from the host, and possibly the network [REF-1138].:LINK:https://www.cve.org/CVERecord?id=CVE-2019-6260::



Notes: ::TYPE:Relationship:NOTE:There is a close association with CWE-250 (Execution with Unnecessary Privileges). CWE-653 is about providing separate components for each privilege; CWE-250 is about ensuring that each component has the least amount of privileges possible. In this fashion, compartmentalization becomes one mechanism for reducing privileges.::TYPE:Terminology:NOTE:The term Separation of Privilege is used in several different ways in the industry, but they generally combine two closely related principles: compartmentalization (this node) and using only one factor in a security decision (CWE-654). Proper compartmentalization implicitly introduces multiple factors into a security decision, but there can be cases in which multiple factors are required for authentication or other mechanisms that do not involve compartmentalization, such as performing all required checks on a submitted certificate. It is likely that CWE-653 and CWE-654 will provoke further discussion.::