CWE-587: Assignment of a Fixed Address to a Pointer
Description
The product sets a pointer to a specific address other than NULL or 0.
Using a fixed address is not portable, because that address will probably not be valid in all environments or platforms.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- IntegrityConfidentialityAvailability
Execute Unauthorized Code or Commands
If one executes code at a known location, an attacker might be able to inject code there beforehand.
- Availability
DoS: Crash, Exit, or Restart; Reduce Maintainability; Reduce Reliability
If the code is ported to another platform or environment, the pointer is likely to be invalid and cause a crash.
- ConfidentialityIntegrity
Read Memory; Modify Memory
The data at a known pointer location can be easily read or influenced by an attacker.
Potential mitigations
- Implementation
Never set a pointer to a fixed address.
Related weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.