2075
Maintenance
This entry is still under development and will continue to see updates and content improvements.
Currently it is expressed as a general absence of a protection mechanism as opposed to a
specific mistake, and the entry's name and description could be interpreted as applying to
software.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
121 Exploit Non-Production Interfaces
681 Exploitation of Improperly Controlled Hardware Security Identifiers
CWE-1260: Improper Handling of Overlap Between Protected Memory Ranges
Weakness ID : 1260
Structure : Simple
Abstraction : Base
Description
The product allows address regions to overlap, which can result in the bypassing of intended
memory protection.
Extended Description
Isolated memory regions and access control (read/write) policies are used by hardware to protect
privileged software. Software components are often allowed to change or remap memory region
definitions in order to enable flexible and dynamically changeable memory management by system
software.
If a software component running at lower privilege can program a memory address region
to overlap with other memory regions used by software running at higher privilege, privilege
escalation may be available to attackers. The memory protection unit (MPU) logic can incorrectly
handle such an address overlap and allow the lower-privilege software to read or write into the
protected memory region, resulting in privilege escalation attack. An address overlap weakness
can also be used to launch a denial of service attack on the higher-privilege software memory
regions.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
CanPrecede 119 Improper Restriction of Operations within the Bounds of a
Memory Buffer