CWE-123 — Write-what-where Condition
CWE-123: Write-what-where Condition
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | High |
Description
Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
Common consequences
- Integrity, Confidentiality, Availability, Access Control: Modify Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, DoS: Crash, Exit, or Restart, Bypass Protection Mechanism
- Integrity, Availability: DoS: Crash, Exit, or Restart, Modify Memory
- Access Control, Other: Bypass Protection Mechanism, Other
Mitigations
Architecture and Design — Use a language that provides appropriate memory abstractions.
Operation — Use OS-level preventative functionality integrated after the fact. Not a complete solution.
References
- CWE page: https://cwe.mitre.org/data/definitions/123.html
- CWE list: https://cwe.mitre.org/data/index.html