2044
Effectiveness = High
Demonstrative Examples
Example 1:
An attacker can render a memory line unusable by repeatedly causing a write to the memory line.
Below is example code from [REF-1058] that the user can execute repeatedly to cause line failure.
W is the maximum associativity of any cache in the system; S is the size of the largest cache in the
system.
Example Language: C++ (Attack)
// Do aligned alloc of (W+1) arrays each of size S
while(1) {
for (ii = 0; ii < W + 1; ii++)
array[ii].element[0]++;
}
Without wear leveling, the above attack will be successful. Simple randomization of blocks will not
suffice as instead of the original physical block, the randomized physical block will be worn out.
Example Language: (Good)
Wear leveling must be used to even out writes to the device.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1202 Memory and Storage Issues 1194 2472
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 4-1 Req SD-4
ISA/IEC 62443 Part 4-1 Req SI-1
ISA/IEC 62443 Part 4-1 Req SVV-3
Related Attack Patterns
CAPEC-ID Attack Pattern Name
212 Functionality Misuse
References
[REF-1058]Moinuddin Qureshi, Michele Franchescini, Vijayalakshmi Srinivasan, Luis Lastras,
Bulent Abali and John Karidis. "Enhancing Lifetime and Security of PCM-Based Main Memory with
Start-Gap Wear Leveling". < https://researcher.watson.ibm.com/researcher/files/us-moinqureshi/
papers-sgap.pdf >.2023-04-07.
[REF-1059]Micron. "Bad Block Management in NAND Flash Memory". < https://www.micron.com/-/
media/client/global/documents/products/technical-note/nand-flash/tn2959_bbm_in_nand_flash.pdf
>.
CWE-1247: Improper Protection Against Voltage and Clock Glitches
CWE Version 4.14
CWE-1247: Improper Protection Against Voltage and Clock Glitches
CWE-1247: Improper Protection Against Voltage and Clock Glitches