2110
regions. For example, pluggable device peripherals should not have write access to program
load memory regions.
Effectiveness = Moderate
Potential Mitigations
Phase: Architecture and Design
Ensure that the design of volatile-memory protections is enough to prevent modification from an
adversary or untrusted code.
Phase: Testing
Test the volatile-memory protections to ensure they are safe from modification or untrusted code.
Demonstrative Examples
Example 1:
A typical SoC secure boot's flow includes fetching the next piece of code (i.e., the boot loader)
from NVM (e.g., serial, peripheral interface (SPI) flash), and transferring it to DRAM/SRAM volatile,
internal memory, which is more efficient.
Example Language: (Bad)
The volatile-memory protections or access controls are insufficient.
The memory from where the boot loader executes can be modified by an adversary.
Example Language: (Good)
A good architecture should define appropriate protections or access controls to prevent modification by an adversary or
untrusted agent, once the bootloader is authenticated.
Observed Examples
Reference Description
CVE-2019-2267 Locked memory regions may be modified through other interfaces in a secureboot-
loader image due to improper access control.
https://www.cve.org/CVERecord?id=CVE-2019-2267
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1196 Security Flow Issues 1194 2469
MemberOf 1343 Weaknesses in the 2021 CWE Most Important
Hardware Weaknesses List
1343 2592
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
456 Infected Memory
679 Exploitation of Improperly Configured or Implemented Memory Protections
CWE-1275: Sensitive Cookie with Improper SameSite Attribute
Weakness ID : 1275
Structure : Simple
CWE Version 4.14
CWE-1275: Sensitive Cookie with Improper SameSite Attribute
CWE-1275: Sensitive Cookie with Improper SameSite Attribute