1648
[REF-696]Ruben Santamarta. "Exploiting Common Flaws in Drivers". 2007 July 1. < http://
reversemode.com/index.php?option=com_content&task=view&id=38&Itemid=1 >.
[REF-697]Yuriy Bulygin. "Remote and Local Exploitation of Network Drivers". 2007 August 1. <
https://www.blackhat.com/presentations/bh-usa-07/Bulygin/Presentation/bh-usa-07-bulygin.pdf >.
[REF-698]Anibal Sacco. "Windows driver vulnerabilities: the METHOD_NEITHER odyssey". 2008
October. < http://www.net-security.org/dl/insecure/INSECURE-Mag-18.pdf >.
[REF-699]Microsoft. "Buffer Descriptions for I/O Control Codes". < https://learn.microsoft.com/enus/
windows-hardware/drivers/kernel/buffer-descriptions-for-i-o-control-codes >.2023-04-07.
[REF-700]Microsoft. "Using Neither Buffered Nor Direct I/O". < https://learn.microsoft.com/en-us/
windows-hardware/drivers/kernel/using-neither-buffered-nor-direct-i-o >.2023-04-07.
[REF-701]Microsoft. "Securing Device Objects". < https://learn.microsoft.com/en-us/windowshardware/
drivers/kernel/controlling-device-access >.2023-04-07.
[REF-702]Piotr Bania. "Exploiting Windows Device Drivers". < https://www.piotrbania.com/all/
articles/ewdd.pdf >.2023-04-07.
CWE-782: Exposed IOCTL with Insufficient Access Control
Weakness ID : 782
Structure : Simple
Abstraction : Variant
Description
The product implements an IOCTL with functionality that should be restricted, but it does not
properly enforce access control for the IOCTL.
Extended Description
When an IOCTL contains privileged functionality and is exposed unnecessarily, attackers may be
able to access this functionality by invoking the IOCTL. Even if the functionality is benign, if the
programmer has assumed that the IOCTL would only be accessed by a trusted process, there may
be little or no validation of the incoming data, exposing weaknesses that would never be reachable
if the attacker cannot call the IOCTL directly.
The implementations of IOCTLs will differ between operating system types and versions, so the
methods of attack and prevention may vary widely.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 749 Exposed Dangerous Method or Function 1564
CanPrecede 781 Improper Address Validation in IOCTL with
METHOD_NEITHER I/O Control Code