Read Time:1 Minute, 12 Second
Description
The software implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Related Weaknesses
CWE-749
CWE-781
Consequences
Integrity, Availability, Confidentiality:
Attackers can invoke any functionality that the IOCTL offers. Depending on the functionality, the consequences may include code execution, denial-of-service, and theft of data.
Potential Mitigations
Phase: Architecture and Design
Effectiveness:
Description:
In Windows environments, use proper access control for the associated device or device namespace. See References.
CVE References
- CVE-2009-2208
- Operating system does not enforce permissions on an IOCTL that can be used to modify network settings.
- CVE-2008-3831
- Device driver does not restrict ioctl calls to its direct rendering manager.
- CVE-2008-3525
- ioctl does not check for a required capability before processing certain requests.
- CVE-2008-0322
- Chain: insecure device permissions allows access to an IOCTL, allowing arbitrary memory to be overwritten.
- CVE-2007-4277
- Chain: anti-virus product uses weak permissions for a device, leading to resultant buffer overflow in an exposed IOCTL.
- CVE-2007-1400
- Chain: sandbox allows opening of a TTY device, enabling shell commands through an exposed ioctl.
- CVE-2006-4926
- Anti-virus product uses insecure security descriptor for a device driver, allowing access to a privileged IOCTL.
- CVE-1999-0728
- Unauthorized user can disable keyboard or mouse by directly invoking a privileged IOCTL.
