Weakness (CWE)
CWE-1260: Improper Handling of Overlap Between Protected Memory Ranges
The product allows address regions to overlap, which can result in the bypassing of intended memory protection.
More detail
Isolated memory regions and access control (read/write) policies are used by hardware to protect privileged software. Software components are often allowed to change or remap memory region definitions in order to enable flexible and dynamically changeable memory management by system software.
How to prevent it (2 mitigations)
-
Architecture and Design
Ensure that memory regions are isolated as intended and that access control (read/write) policies are used by hardware to protect privileged software.
-
Implementation
For all of the programmable memory protection regions, the memory protection unit (MPU) design can define a priority scheme.
For example: if three memory regions can be programmed (Region_0, Region_1, and Region_2), the design can enforce a priority scheme, such that, if a system address is within multiple regions, then the region with the lowest ID takes priority and the access-control policy of that region will be applied. In some MPU designs, the priority scheme can also be programmed by trusted software.
Hardware logic or trusted firmware can also check for region definitions and block programming of memory regions with overlapping addresses.
The memory-access-control-check filter can also be designed to apply a policy filter to all of the overlapping ranges, i.e., if an address is within Region_0 and Region_1, then access to this address is only granted if both Region_0 and Region_1 policies allow the access.
Source: MITRE CWE-1260
13 results · Clear filters · Feed
-
Medium 5.9
Improper handling of overlap between protected memory ranges in the Secure Encrypted Virtualization (SEV) firmware coul…
-
Medium 6.3
HPE NonStop Kernel - Access to unmapped or privileged data
A security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped data.
-
Medium 6.8
Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring…
-
Medium 6.2
Watchr 1.1.0.0 Denial of Service via Search
Watchr 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 8145 characters into the search bar and trigge…
-
Medium 6.2
VSCO 1.1.1.0 Denial of Service via Search
VSCO 1.1.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string through the search functionality. Attackers can paste a buffer of 5000 characters into the search bar and nav…
-
Medium 5.5
GSearch 1.0.1.0 Denial of Service via Search Input
GSearch 1.0.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by inputting an excessively long string in the search bar. Attackers can paste a buffer of 2000 characters into the search field, click search, and…
-
Medium 6.2
PHPRunner 10.1 Denial of Service via Dashboard Name Field
PHPRunner 10.1 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the dashboard name field. Attackers can paste a buffer of 10000 characters into the Name field during das…
-
Medium 6.2
Deluge 1.3.15 Denial of Service via Webseeds Field
Deluge 1.3.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Webseeds field. Attackers can paste a buffer of 5000 bytes into the Webseeds field during torrent crea…
-
Medium 6.2
NordVPN 6.19.6 Denial of Service via Email Field Buffer Overflow
NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Attackers can paste a buffer of 100,000 characters into the email field during lo…
-
Medium 5.5
RealTerm Serial Terminal 2.0.0.70 Denial of Service via Port Field
RealTerm Serial Terminal 2.0.0.70 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Port field. Attackers can paste a buffer of 1000 characters into the Port input fi…
-
Medium 5.5
SpotPaltalk 1.1.5 Name/Key Field Denial of Service
SpotPaltalk 1.1.5 contains a denial of service vulnerability in the registration code input field that allows local attackers to crash the application by submitting an excessively long string. Attackers can paste a buffer of 1000 characters into the Name/Key …
-
Medium 6.8
Improper handling of overlap between the segmented reverse map table (RMP) and system management mode (SMM) memory coul…
-
Medium 5.9
Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to byp…