CAPEC-679
Exploitation of Improperly Configured or Implemented Memory Protections
An adversary takes advantage of missing or incorrectly configured access control within memory to read/write data or inject malicious code into said memory.
On this page
Hardware product designs often need to implement memory protection features to prevent users from reading and modifying memory reserved for security operations such as secure booting, authenticating code, device attestation, and more. However, these protection features may be missing if not configured by developers. For example, this can occur if the developers assume these features are configured elsewhere. Additionally, developers often attempt to impose proper protection features, but may incorrectly configure these controls. One such example would be setting controls with insufficient granularity for protected address regions. If an adversary is able to discover improper access controls surrounding memory, it could result in the adversary obtaining sensitive data, executing code, circumventing security mechanisms, escalating privileges, or even denying service to higher privilege software.
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-679: Exploitation of Improperly Configured or Implemented Memory Protections: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/679.html and https://cve.bz/cve/capec/679?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
Access to the hardware being leveraged.
Skills required
- Medium skill
Ability to craft malicious code to inject into the memory region.
- High skill
Intricate knowledge of memory structures.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Modify Data | Integrity | |
| Read Data | Confidentiality | |
| Execute Unauthorized Commands | Confidentiality, Integrity, Availability | Run Arbitrary Code |
| Gain Privileges | Confidentiality, Access Control, Authorization |
Mitigations
Ensure that protected and unprotected memory ranges are isolated and do not overlap.
If memory regions must overlap, leverage memory priority schemes if memory regions can overlap.
Ensure that original and mirrored memory regions apply the same protections.
Ensure immutable code or data is programmed into ROM or write-once memory.
Weaknesses it exploits
- CWE-1222 Insufficient Granularity of Address Regions Protected by Register Locks
- CWE-1252 CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
- CWE-1257 Improper Access Control Applied to Mirrored or Aliased Memory Regions
- CWE-1260 Improper Handling of Overlap Between Protected Memory Ranges
- CWE-1274 Improper Access Control for Volatile Memory Containing Boot Code
- CWE-1282 Assumed-Immutable Data is Stored in Writable Memory
- CWE-1312 Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
- CWE-1316 Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
- CWE-1326 Missing Immutable Root of Trust in Hardware
Recent CVEs with these weaknesses
- 6.3CVE-2026-76668
A security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped data.
- 6.8CVE-2026-20760
Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring 0: Hypervisor may allow an escalation of privilege. Authorized adversary with a privileged user combined with a low com…
- 7.0CVE-2025-31936
Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within SMM may allow an escalation of privilege. SMM adversary with a privileged user combined with a high complexi…
- 4.6CVE-2024-36345
Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attacker to perform an out-of-bounds read, potentially resulting in loss of confidentiality.
- 6.9CVE-2018-25244
Eco Search 1.0.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 950 or more characters…
- 6.9CVE-2018-25240
Watchr 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 8145 characters into the s…
- 6.9CVE-2018-25238
VSCO 1.1.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string through the search functionality. Attackers can paste a buffer of 5000 characters into th…
- 6.9CVE-2019-25655
Device Monitoring Studio 8.10.00.8925 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the server connection dialog. Attackers can trigger the crash …
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
Examples
A hardware product contains non-volatile memory, which itself contains boot code that is insufficiently prote…
A hardware product contains non-volatile memory, which itself contains boot code that is insufficiently protected. An adversary then modifies this memory to either bypass the secure boot process or to execute their own code.
A hardware product leverages a CPU that does not possess a memory-protection unit (MPU) and a memory-manageme…
A hardware product leverages a CPU that does not possess a memory-protection unit (MPU) and a memory-management unit (MMU) nor a special bit to support write exclusivity, resulting in no write exclusivity. Because of this, an adversary is able to inject malicious code into the memory and later execute it to achieve the desired outcome.
MITRE's words, unchanged: CAPEC-679 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.