1647
are available for this task. Also properly protect and manage the user-supplied buffers, since the
I/O Manager does not do this when METHOD_NEITHER is being used. See References.
Phase: Architecture and Design
If possible, avoid using METHOD_NEITHER in the IOCTL and select methods that
effectively control the buffer size, such as METHOD_BUFFERED, METHOD_IN_DIRECT, or
METHOD_OUT_DIRECT.
Phase: Architecture and Design
Phase: Implementation
If the IOCTL is part of a driver that is only intended to be accessed by trusted users, then use
proper access control for the associated device or device namespace. See References.
Observed Examples
Reference Description
CVE-2006-2373 Driver for file-sharing and messaging protocol allows attackers to execute
arbitrary code.
https://www.cve.org/CVERecord?id=CVE-2006-2373
CVE-2009-0686 Anti-virus product does not validate addresses, allowing attackers to gain
SYSTEM privileges.
https://www.cve.org/CVERecord?id=CVE-2009-0686
CVE-2009-0824 DVD software allows attackers to cause a crash.
https://www.cve.org/CVERecord?id=CVE-2009-0824
CVE-2008-5724 Personal firewall allows attackers to gain SYSTEM privileges.
https://www.cve.org/CVERecord?id=CVE-2008-5724
CVE-2007-5756 chain: device driver for packet-capturing software allows access to an
unintended IOCTL with resultant array index error.
https://www.cve.org/CVERecord?id=CVE-2007-5756
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1406 Comprehensive Categorization: Improper Input
Validation
1400 2531
Notes
Applicable Platform
Because IOCTL functionality is typically performing low-level actions and closely interacts
with the operating system, this weakness may only appear in code that is written in low-level
languages.
Research Gap
While this type of issue has been known since 2006, it is probably still under-studied and underreported.
Most of the focus has been on high-profile software and security products, but other
kinds of system software also use drivers. Since exploitation requires the development of custom
code, it requires some skill to find this weakness. Because exploitation typically requires local
privileges, it might not be a priority for active attackers. However, remote exploitation may be
possible for software such as device drivers. Even when remote vectors are not available, it may
be useful as the final privilege-escalation step in multi-stage remote attacks against applicationlayer
software, or as the primary attack by a local user on a multi-user system.
References
CWE Version 4.14
CWE-782: Exposed IOCTL with Insufficient Access Control
CWE-782: Exposed IOCTL with Insufficient Access Control