1979
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : System on Chip (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Modify Memory
DMA devices have direct write access to main memory
and due to time of attack will be able to bypass OS or
Bootloader access control.
High
Potential Mitigations
Phase: Architecture and Design
Utilize an IOMMU to orchestrate IO access from the start of the boot process.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1196 Security Flow Issues 1194 2469
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Related Attack Patterns
CAPEC-ID Attack Pattern Name
180 Exploiting Incorrectly Configured Access Control Security Levels
References
[REF-1038]"DMA attack". 2019 October 9. < https://en.wikipedia.org/wiki/DMA_attack >.
[REF-1039]A. Theodore Markettos, Colin Rothwell, Brett F. Gutstein, Allison Pearce,
Peter G. Neumann, Simon W. Moore and Robert N. M. Watson. "Thunderclap: Exploring
Vulnerabilities in Operating System IOMMU Protection via DMA from Untrustworthy
Peripherals". 2019 February 5. < https://www.ndss-symposium.org/wp-content/uploads/2019/02/
ndss2019_05A-1_Markettos_paper.pdf >.
[REF-1040]Maximillian Dornseif, Michael Becher and Christian N. Klein. "FireWire all
your memory are belong to us". 2005. < http://www.orkspace.net/secdocs/Conferences/
CanSecWest/2005/0wn3d%20by%20an%20iPod%20-%20Firewire1394%20Issues.pdf
>.2023-04-07.
[REF-1041]Rory Breuk, Albert Spruyt and Adam Boileau. "Integrating DMA attacks in exploitation
frameworks". 2012 February 0. < https://www.os3.nl/_media/2011-2012/courses/rp1/p14_report.pdf
>.
[REF-1042]Maximillian Dornseif. "Owned by an iPod". 2004. < https://web.archive.org/
web/20060505224959/https://pacsec.jp/psj04/psj04-dornseif-e.ppt >.2023-04-07.
[REF-1044]Dmytro Oleksiuk. "My aimful life". 2015 September 2. < http://blog.cr4.sh/2015/09/
breaking-uefi-security-with-software.html >.
[REF-1046]A. Theodore Markettos and Adam Boileau. "Hit by a Bus:Physical Access Attacks with
Firewire". 2006. < https://security-assessment.com/files/presentations/ab_firewire_rux2k6-final.pdf
>.
CWE Version 4.14
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control