Description
Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
Potential Impact
- Integrity: Modify Memory
- Integrity: DoS: Crash, Exit, or Restart
- Access Control: Bypass Protection Mechanism
How to Fix
Architecture and Design
Use a language that provides appropriate memory abstractions.
Operation
Use OS-level preventative functionality integrated after the fact. Not a complete solution.
Detection Methods
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...
- Automated Dynamic Analysis: Use tools that are integrated during
compilation to insert runtime error-checking mechanisms
related to memory safety errors, such as AddressSanitizer
(ASan) for C/C++ [REF-1518]....
Related Weaknesses
References
View on MITRE CWE Database →
