Weakness (CWE)
CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code
Base
The product conducts a secure-boot process that transfers bootloader code from Non-Volatile Memory (NVM) into Volatile Memory (VM), but it does not have sufficient access control or other protections for the Volatile Memory.
How to prevent it (2 mitigations)
-
Architecture and Design
Ensure that the design of volatile-memory protections is enough to prevent modification from an adversary or untrusted code.
-
Testing
Test the volatile-memory protections to ensure they are safe from modification or untrusted code.
Source: MITRE CWE-1274
9 results · Feed
-
Medium 4.6
Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attac…
-
High 7.1
Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory l…
-
Medium 6.1
A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically pro…
-
Medium 6.8
The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patc…
-
High 7.5
Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with its bootloader unlocked. This permits b…
-
Medium 6.8
Milesight UG65-868M-EA Improper Access Control for Volatile Memory Containing Boot Code
An admin user can gain unauthorized write access to the /etc/rc.local file on the device, which is executed on a system boot.
-
High 7.5
Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to…
-
High 8.4
The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker t…
-
High 8.4
A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow a…