目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-1220 类漏洞列表 95

CWE-1220 类弱点 95 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1220 属于访问控制粒度不足漏洞。当访问控制策略过于宽泛，未能精确区分受信任与未受信任的代理时，攻击者可利用此缺陷访问敏感资产。开发者应实施最小权限原则，细化访问控制策略，确保仅授予必要的读写权限，从而防止未授权访问，提升系统安全性。

MITRE CWE 官方描述
CWE：CWE-1220 访问控制粒度不足 英文：产品通过策略或其他功能实施访问控制，旨在禁用或限制来自不受信任代理对系统中资产的访问（读取和/或写入）。然而，实施的访问控制缺乏所需的粒度，导致控制策略过于宽泛，因为它允许未经授权的代理访问安全敏感的资产。 集成电路和硬件引擎可以向受信任的固件或软件模块（通常由 BIOS/引导加载程序设置）暴露对资产（设备配置、密钥等）的访问。此类访问通常受到访问控制。在电源重置后，硬件或系统通常以寄存器中的默认值启动，受信任的固件（引导固件）配置必要的访问控制保护。此类保护方案中可能存在的一个常见弱点是访问控制或策略的粒度不够细。这种状况允许超出受信任代理范围的代理访问资产，可能导致功能丧失或无法安全地设置设备。这进一步导致从泄露的敏感密钥材料到设备配置被修改的安全风险。
常见影响 (1)
Confidentiality, Integrity, Availability, Access Control Modify Memory, Read Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Other
缓解措施 (1)
Architecture and Design, Implementation, Testing Access-control-policy protections must be reviewed for design inconsistency and common weaknesses. Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
Effectiveness: High
代码示例 (2)
Consider a system with a register for storing AES key for encryption or decryption. The key is 128 bits, implemented as a set of four 32-bit registers. The key registers are assets and registers, AES_KEY_READ_POLICY and AES_KEY_WRITE_POLICY, and are defined to provide necessary access controls. The read-policy register defines which agents can read the AES-key registers, and write-policy register …
Register Field description AES_ENC_DEC_KEY_0 AES key [0:31] for encryption or decryption Default 0x00000000 AES_ENC_DEC_KEY_1 AES key [32:63] for encryption or decryption Default 0x00000000 AES_ENC_DEC_KEY_2 AES key [64:95] for encryption or decryption Default 0x00000000 AES_ENC_DEC_KEY_4 AES key [96:127] for encryption or decryption Default 0x00000000 AES_KEY_READ_WRITE_POLICY [31:0] Default 0x00000006 - meaning agent with identities "1" and "2" can both read from and write to key registers
Bad · Other
AES_KEY_READ_POLICY [31:0] Default 0x00000002 - meaning only Crypto engine with identity "1" can read registers: AES_ENC_DEC_KEY_0, AES_ENC_DEC_KEY_1, AES_ENC_DEC_KEY_2, AES_ENC_DEC_KEY_3 AES_KEY_WRITE_POLICY [31:0] Default 0x00000004 - meaning only trusted firmware with identity "2" can program registers: AES_ENC_DEC_KEY_0, AES_ENC_DEC_KEY_1, AES_ENC_DEC_KEY_2, AES_ENC_DEC_KEY_3
Good · Other
Within the AXI node interface wrapper module in the RISC-V AXI module of the HACK@DAC'19 CVA6 SoC [REF-1346], an access control mechanism is employed to regulate the access of different privileged users to peripherals.
... for (i=0; i<NB_SUBORDINATE; i++) begin for (j=0; j<NB_MANAGER; j++) begin assign connectivity_map_o[i][j] = access_ctrl_i[i][j][priv_lvl_i] || ((j==6) && access_ctrl_i[i][7][priv_lvl_i]); end end ...
Bad · Verilog
... for (i=0; i<NB_SUBORDINATE; i++) begin for (j=0; j<NB_MANAGER; j++) begin assign connectivity_map_o[i][j] = access_ctrl_i[i][j][priv_lvl_i]; end end ...
Good · Verilog
CVE ID 标题 CVSS 风险等级 Published
CVE-2022-4801 memos 授权问题漏洞 — usememos/memos 4.3 - 2022-12-28
CVE-2022-2475 Haas Automation Controller 安全漏洞 — Haas CNC Controller 9.8 Critical 2022-10-28
CVE-2022-36110 Gravitl Netmaker 安全漏洞 — netmaker 8.8 High 2022-09-09
CVE-2022-1461 OpenEMR安全漏洞 — openemr/openemr 6.5 - 2022-04-25
CVE-2022-1177 OpenEMR 安全漏洞 — openemr/openemr 4.3 - 2022-03-30

CWE-1220 是常见的弱点类别，本平台收录该类弱点关联的 95 条 CVE 漏洞。