Improper Handling of Overlap Between Protected Memory Ranges
The product allows address regions to overlap, which can result in the bypassing of intended memory protection.
Isolated memory regions and access control (read/write) policies are used by hardware to protect privileged software. Software components are often allowed to change or remap memory region definitions in order to enable flexible and dynamically changeable memory management by system software.
If a software component running at lower privilege can program a memory address region to overlap with other memory regions used by software running at higher privilege, privilege escalation may be available to attackers. The memory protection unit (MPU) logic can incorrectly handle such an address overlap and allow the lower privilege software to read or write into the protected memory region resulting in privilege escalation attack. Address overlap weakness can also be used to launch a denial of service attack on the higher privilege software memory regions.
The following examples help to illustrate the nature of this weakness and describe methods or techniques which can be used to mitigate the risk.
Note that the examples here are by no means exhaustive and any given weakness may have many subtle varieties, each of which may require different detection methods or runtime controls.
For example, consider a design with a 16-bit address that has two software privilege levels: Privilege_SW and Non_privilege_SW. To isolate the system memory regions accessible by these two privilege levels, the design supports three memory regions: Region_0, Region_1, Region_2.
Region_0 & Region_1: registers are programmable by Privilege_SW
Region_2: registers are programmable by Non_privilege_SW
Each region range is defined by two 32 bit registers Address_range and Access_policy:
Address_range[15:0]: specifies the Base address of the region
Address_range[31:16]: specifies the size of the region
Access_policy: if set to one, allows reads from Non_privilege_SW
Access_policy: if set to one, allows writes from Non_privilege_SW
Access_policy: if set to one, allows reads from Privilege_SW
Access_policy: if set to one, allows writes from Privilege_SW
The address-protection filter checks the address range and access policies of all three regions and only allows software access if all three filters allow access.
Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of s...
This view (slice) covers all the elements in CWE.
CWE identifiers in this view are weaknesses that do not have associated Software Fault Patterns (SFPs), as covered by the CWE-888 view. As such, they represent gaps in...
This view (slice) lists weaknesses that can be introduced during implementation.