CWE-1246
AllowedImproper Write Handling in Limited-write Non-Volatile Memories
Abstraction: Base · Status: Incomplete
The product does not implement or incorrectly implements wear leveling operations in limited-write non-volatile memories.
2 vulnerabilities reference this CWE, most recent first.
GHSA-M325-8P6V-XM3F
Vulnerability from github – Published: 2023-06-15 12:30 – Updated: 2024-04-04 04:51Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5, SHA-1 or SHA-256.
{
"affected": [],
"aliases": [
"CVE-2023-32229"
],
"database_specific": {
"cwe_ids": [
"CWE-1246",
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-15T11:15:09Z",
"severity": "MODERATE"
},
"details": "Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option (signing of the video stream) with option MD5, SHA-1 or SHA-256.",
"id": "GHSA-m325-8p6v-xm3f",
"modified": "2024-04-04T04:51:52Z",
"published": "2023-06-15T12:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32229"
},
{
"type": "WEB",
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-435698-BT.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QHPV-2VQR-F66V
Vulnerability from github – Published: 2024-07-15 21:31 – Updated: 2024-07-15 21:31An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS firmware before 4.4.
{
"affected": [],
"aliases": [
"CVE-2024-36432"
],
"database_specific": {
"cwe_ids": [
"CWE-1246"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-15T19:15:02Z",
"severity": "HIGH"
},
"details": "An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS firmware before 4.4.",
"id": "GHSA-qhpv-2vqr-f66v",
"modified": "2024-07-15T21:31:06Z",
"published": "2024-07-15T21:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36432"
},
{
"type": "WEB",
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"type": "WEB",
"url": "https://www.supermicro.com/zh_tw/support/security_BIOS_Jul_2024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Include secure wear leveling algorithms and ensure they may not be bypassed.
CAPEC-212: Functionality Misuse
An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact. The system functionality is not altered or modified but used in a way that was not intended. This is often accomplished through the overuse of a specific functionality or by leveraging functionality with design flaws that enables the adversary to gain access to unauthorized, sensitive data.