1649
Language : C (Prevalence = Often)
Language : C++ (Prevalence = Often)
Operating_System : Unix (Prevalence = Undetermined)
Operating_System : Windows (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Availability
Confidentiality
Varies by Context
Attackers can invoke any functionality that the IOCTL
offers. Depending on the functionality, the consequences
may include code execution, denial-of-service, and theft of
data.
Potential Mitigations
Phase: Architecture and Design
In Windows environments, use proper access control for the associated device or device
namespace. See References.
Observed Examples
Reference Description
CVE-2009-2208 Operating system does not enforce permissions on an IOCTL that can be used
to modify network settings.
https://www.cve.org/CVERecord?id=CVE-2009-2208
CVE-2008-3831 Device driver does not restrict ioctl calls to its direct rendering manager.
https://www.cve.org/CVERecord?id=CVE-2008-3831
CVE-2008-3525 ioctl does not check for a required capability before processing certain
requests.
https://www.cve.org/CVERecord?id=CVE-2008-3525
CVE-2008-0322 Chain: insecure device permissions allows access to an IOCTL, allowing
arbitrary memory to be overwritten.
https://www.cve.org/CVERecord?id=CVE-2008-0322
CVE-2007-4277 Chain: anti-virus product uses weak permissions for a device, leading to
resultant buffer overflow in an exposed IOCTL.
https://www.cve.org/CVERecord?id=CVE-2007-4277
CVE-2007-1400 Chain: sandbox allows opening of a TTY device, enabling shell commands
through an exposed ioctl.
https://www.cve.org/CVERecord?id=CVE-2007-1400
CVE-2006-4926 Anti-virus product uses insecure security descriptor for a device driver,
allowing access to a privileged IOCTL.
https://www.cve.org/CVERecord?id=CVE-2006-4926
CVE-1999-0728 Unauthorized user can disable keyboard or mouse by directly invoking a
privileged IOCTL.
https://www.cve.org/CVERecord?id=CVE-1999-0728
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
CWE Version 4.14
CWE-783: Operator Precedence Logic Error
CWE-783: Operator Precedence Logic Error