Description
The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
When a weakness occurs in functionality that is accessible by lower-privileged users, then without strong boundaries, an attack might extend the scope of the damage to higher-privileged users.
Potential Impact
Access Control
Gain Privileges or Assume Identity, Bypass Protection Mechanism
Mitigations & Prevention
Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.
Detection Methods
- Automated Static Analysis - Binary or Bytecode SOAR Partial — According to SOAR, the following detection techniques may be useful:
- Manual Static Analysis - Source Code High — According to SOAR, the following detection techniques may be useful:
- Architecture or Design Review High — According to SOAR, the following detection techniques may be useful:
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2021-33096 | Improper isolation of shared resource in a network-on-chip leads to denial of service |
| CVE-2019-6260 | Baseboard Management Controller (BMC) device implements Advanced High-performance Bus (AHB) bridges that do not require authentication for arbitrary read and write access to the BMC's physical address |
Related Weaknesses
Frequently Asked Questions
What is CWE-653?
CWE-653 (Improper Isolation or Compartmentalization) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Class-level weakness. The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
How can CWE-653 be exploited?
Attackers can exploit CWE-653 (Improper Isolation or Compartmentalization) to gain privileges or assume identity, bypass protection mechanism. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.
How do I prevent CWE-653?
Key mitigations include: Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.
What is the severity of CWE-653?
CWE-653 is classified as a Class-level weakness (High abstraction). It has been observed in 2 real-world CVEs.