CWEweakness

CWE-1282 Assumed-Immutable Data is Stored in Writable Memory

Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

Immutable data, such as a first-stage bootloader, device identifiers, and "write-once" configuration settings are stored in writable memory that can be re-programmed or updated in the field.

Common consequences

• Integrity: Varies by Context — Security is lost if assets assumed to be immutable can be modified.

Potential mitigations

• [Implementation] Storing immutable code or data in read-only memory (ROM), fuses, or one-time programmable (OTP) memory provides strong integrity guarantees and provides a root of trust for securing the rest of the system.

Related

Attack pattern · CAPEC (2)

  • CAPEC-458 Flash Memory Attacks attack pattern
  • CAPEC-679 Exploitation of Improperly Configured or Implemented Memory Protections attack pattern

Can precede · CWE (1)

  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

Child of · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

Referenced by CAPEC · weakness (2)

  • CAPEC-458 Flash Memory Attacks attack pattern
  • CAPEC-679 Exploitation of Improperly Configured or Implemented Memory Protections attack pattern

Referenced by CVE · weakness (8)

  • CVE-2018-25229 BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the SMTP configuration interface that allows local… vulnerability
  • CVE-2019-25583 RarmaRadio 2.72.3 contains a denial of service vulnerability in the Username field that allows local attackers to crash the application by… vulnerability
  • CVE-2019-25587 BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the Storage-Path configuration parameter that allows local… vulnerability
  • CVE-2019-25588 BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the DNS Address field that allows local attackers to crash… vulnerability
  • CVE-2019-25590 Axessh 4.2 contains a denial of service vulnerability in the logging configuration that allows local attackers to crash the application by… vulnerability
  • CVE-2019-25551 Sandboxie 5.30 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively… vulnerability
  • CVE-2019-25358 FileOptimizer 14.00.2524 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the… vulnerability
  • CVE-2022-2483 The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification… vulnerability