Tag Archives: Exposed IOCTL with Insufficient Access Control

CWE-782 – Exposed IOCTL with Insufficient Access Control

Read Time:1 Minute, 12 Second

Description

The software implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.

Modes of Introduction:

– Architecture and Design

Likelihood of Exploit:

 

Related Weaknesses

CWE-749
CWE-781

 

Consequences

Integrity, Availability, Confidentiality:

Attackers can invoke any functionality that the IOCTL offers. Depending on the functionality, the consequences may include code execution, denial-of-service, and theft of data.

 

Potential Mitigations

Phase: Architecture and Design

Effectiveness:

Description: 

In Windows environments, use proper access control for the associated device or device namespace. See References.

CVE References

 

  • CVE-2009-2208
    • Operating system does not enforce permissions on an IOCTL that can be used to modify network settings.
  • CVE-2008-3831
    • Device driver does not restrict ioctl calls to its direct rendering manager.
  • CVE-2008-3525
    • ioctl does not check for a required capability before processing certain requests.
  • CVE-2008-0322
    • Chain: insecure device permissions allows access to an IOCTL, allowing arbitrary memory to be overwritten.
  • CVE-2007-4277
    • Chain: anti-virus product uses weak permissions for a device, leading to resultant buffer overflow in an exposed IOCTL.
  • CVE-2007-1400
    • Chain: sandbox allows opening of a TTY device, enabling shell commands through an exposed ioctl.
  • CVE-2006-4926
    • Anti-virus product uses insecure security descriptor for a device driver, allowing access to a privileged IOCTL.
  • CVE-1999-0728
    • Unauthorized user can disable keyboard or mouse by directly invoking a privileged IOCTL.