1724
An attacker can supply a pointer for memory locations that the product is not expecting. If the
pointer is dereferenced for a write operation, the attack might allow modification of critical state
variables, cause a crash, or execute code. If the dereferencing operation is for a read, then the
attack might allow reading of sensitive data, cause a crash, or set a variable to an unexpected
value (since the value will be read from an unexpected memory location).
There are several variants of this weakness, including but not necessarily limited to:
• The untrusted value is directly invoked as a function call.
• In OS kernels or drivers where there is a boundary between "userland" and privileged
memory spaces, an untrusted pointer might enter through an API or system call (see
CWE-781 for one such example).
• Inadvertently accepting the value from an untrusted control sphere when it did not have to be
accepted as input at all. This might occur when the code was originally developed to be run
by a single user in a non-networked environment, and the code is then ported to or otherwise
exposed to a networked environment.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 119 Improper Restriction of Operations within the Bounds of a
Memory Buffer