CAPEC-679: Exploitation of Improperly Configured or Implemented Memory Protections
Description
An adversary takes advantage of missing or incorrectly configured access control within memory to read/write data or inject malicious code into said memory.
- Likelihood of attack
- Medium
- Typical severity
- Very High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Subvert Access Control
Prerequisites
- Access to the hardware being leveraged.
Skills required
- MediumAbility to craft malicious code to inject into the memory region.
- HighIntricate knowledge of memory structures.
Consequences
- Integrity
Modify Data
- Confidentiality
Read Data
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code
- ConfidentialityAccess ControlAuthorization
Gain Privileges
Mitigations
- Ensure that protected and unprotected memory ranges are isolated and do not overlap.
- If memory regions must overlap, leverage memory priority schemes if memory regions can overlap.
- Ensure that original and mirrored memory regions apply the same protections.
- Ensure immutable code or data is programmed into ROM or write-once memory.
Related weaknesses (CWE)
- CWE-1222Insufficient Granularity of Address Regions Protected by Register Locks
- CWE-1252CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
- CWE-1257Improper Access Control Applied to Mirrored or Aliased Memory Regions
- CWE-1260Improper Handling of Overlap Between Protected Memory Ranges
- CWE-1274Improper Access Control for Volatile Memory Containing Boot Code
- CWE-1282Assumed-Immutable Data is Stored in Writable Memory
- CWE-1312Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
- CWE-1316Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
- CWE-1326Missing Immutable Root of Trust in Hardware