Detail CWE-781

CWE-781

Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
2009-07-27
00h00 +00:00
Draft
2026-10-28
00h00 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code

The product defines an IOCTL that uses METHOD_NEITHER for I/O, but it does not validate or incorrectly validates the addresses that are provided.

Informasi Umum

Mode Pengenalan

Implementation

Platform yang Berlaku

Bahasa

Nama: C (Often)
Nama: C++ (Often)

Sistem Operasi

Nama: Windows NT (Sometimes)

Konsekuensi Umum

Cakupan Dampak Kemungkinan
Integrity
Availability
Confidentiality		Modify Memory, Read Memory, Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart

Catatan: If validation is missing or incorrect, an attacker can supply arbitrary memory addresses for memory that belongs to another process or user. If the attacker can control the contents that the IOCTL writes, it may lead to code execution at high privilege levels. At the least, a crash can occur.

Contoh yang Diamati

Referensi Deskripsi

CVE-2006-2373

Driver for file-sharing and messaging protocol allows attackers to execute arbitrary code.

CVE-2009-0686

Anti-virus product does not validate addresses, allowing attackers to gain SYSTEM privileges.

CVE-2009-0824

DVD software allows attackers to cause a crash.

CVE-2008-5724

Personal firewall allows attackers to gain SYSTEM privileges.

CVE-2007-5756

Chain: device driver for packet-capturing software allows access to an unintended IOCTL with resultant array index error.

Mitigasi yang Memungkinkan

Phases : Implementation
If METHOD_NEITHER is required for the IOCTL, then ensure that all user-space addresses are properly validated before they are first accessed. The ProbeForRead and ProbeForWrite routines are available for this task. Also properly protect and manage the user-supplied buffers, since the I/O Manager does not do this when METHOD_NEITHER is being used. See References.
Phases : Architecture and Design
If possible, avoid using METHOD_NEITHER in the IOCTL and select methods that effectively control the buffer size, such as METHOD_BUFFERED, METHOD_IN_DIRECT, or METHOD_OUT_DIRECT.
Phases : Architecture and Design // Implementation
If the IOCTL is part of a driver that is only intended to be accessed by trusted users, then use proper access control for the associated device or device namespace. See References.

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Catatan



Referensi

REF-696

Exploiting Common Flaws in Drivers
Ruben Santamarta.
http://reversemode.com/index.php?option=com_content&task=view&id=38&Itemid=1

REF-697

Remote and Local Exploitation of Network Drivers
Yuriy Bulygin.
https://www.blackhat.com/presentations/bh-usa-07/Bulygin/Presentation/bh-usa-07-bulygin.pdf

REF-698

Windows driver vulnerabilities: the METHOD_NEITHER odyssey
Anibal Sacco.
http://www.net-security.org/dl/insecure/INSECURE-Mag-18.pdf

REF-699

Buffer Descriptions for I/O Control Codes
Microsoft.
https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/buffer-descriptions-for-i-o-control-codes

REF-700

Using Neither Buffered Nor Direct I/O
Microsoft.
https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/using-neither-buffered-nor-direct-i-o

REF-701

Securing Device Objects
Microsoft.
https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/controlling-device-access

REF-702

Exploiting Windows Device Drivers
Piotr Bania.
https://www.piotrbania.com/all/articles/ewdd.pdf

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
CWE Content Team MITRE 2009-07-15 +00:00 2009-07-27 +00:00 1.5

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2009-12-28 +00:00 updated Common_Consequences, Potential_Mitigations, References, Time_of_Introduction
CWE Content Team MITRE 2010-09-27 +00:00 updated Relationships
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2017-11-08 +00:00 updated Applicable_Platforms, Likelihood_of_Exploit, References
CWE Content Team MITRE 2020-02-24 +00:00 updated Relationships
CWE Content Team MITRE 2020-06-25 +00:00 updated Relationships
CWE Content Team MITRE 2023-01-31 +00:00 updated Description
CWE Content Team MITRE 2023-04-27 +00:00 updated References, Relationships, Time_of_Introduction
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-12-11 +00:00 updated Weakness_Ordinalities
CWE Content Team MITRE 2026-10-28 +00:00 updated Common_Consequences, Description
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.