tid-110
Vulnerability from emb3d
Certain software-executed attacks can introduce a fault to the physical hardware of the device, leading to greater access or exploit opportunities. Typically, these kinds of attacks involve performing a software action that would necessitate a predictable and controllable reaction in hardware. If this hardware action contains properties that allow for some kind of fault to occur, then the threat actor can inject the fault through software and try to leverage it into an exploit. For example, the Rowhammer exploit demonstrates how repeated dynamic random access memory (DRAM) accesses can lead to a privilege escalation exploit. This exploit is possible through the combination of DRAM cells being placed very close together and attackers repeatedly accessing the same physical cells on the DRAM from software. This repeated access causes a leakage of electric charge within the memory, leading to a manipulation of the charge of nearby memory locations. This induced charge manipulation results in a manipulation of the contents of memory itself. By manipulating the contents of memory, the threat actor may be able to escalate privileges on a device or otherwise bypass security controls.
- CWE-1256: Improper Restriction of Software Interfaces to Hardware Interfaces
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.