CWE-123 Write-what-where Condition: When Attackers Pick the Address

CWE-123, the write-what-where condition, is any situation where an attacker can write an arbitrary value to an arbitrary location. MITRE notes it often results from a buffer overflow. It is less a single coding mistake than a powerful outcome that other bugs produce.

Affected platforms are memory-unsafe languages, C and C++. If you maintain native parsers, renderers, kernels or drivers, this is the kind of capability you do not want anyone to have.

How it happens

Most memory corruption is limited. The attacker overflows a buffer and damages whatever sits nearby. A write-what-where is different. The attacker controls two things: the value to write (the what) and the address to write to (the where).

That usually happens when corrupted data is used as a pointer or an offset. Imagine a structure with a pointer field that sits after a buffer. An overflow rewrites the pointer, and the next ordinary assignment through that pointer writes the attacker's value to the attacker's address.

// Illustrative pattern: a pointer lives next to a buffer
struct item {
    char name[16];
    int *counter;
};

void update(struct item *it, const char *name, int v) {
    strcpy(it->name, name);   // overflow can rewrite it->counter
    *it->counter = v;         // now writes v wherever counter points
}

This is a teaching sketch, not a real product. The point is that a first bug (the unbounded copy) feeds a second step (the write through a pointer).

MITRE's examples are both chains that start earlier. CVE-2022-0545 is a 3D renderer with an integer overflow that leads to a write-what-where condition using a crafted image. CVE-2019-19911 is a Python library that does not limit the resources used to process images with a very large number of bands, leading to excessive memory consumption or an integer overflow.

What an attacker gains

MITRE describes write-what-where as clearly able to write data outside the scope of allowed memory. The listed consequences are broad.

• Code execution and privilege gain. The attacker may modify memory, execute unauthorized code or commands, and gain privileges or assume identity.
• Bypassing protections. Writing to chosen locations lets an attacker change settings, flags or function pointers that defenses rely on.
• Crashes. Many memory accesses can end in program termination, such as writing to addresses that are invalid for the process.

Because the attacker chooses the target, the reliability of exploitation is high compared to a plain overflow.

How to find it

MITRE lists two detection methods.

1. Static analysis. SAST tools can find some instances by analyzing source code or binaries without running them.
2. Runtime checks. Build with AddressSanitizer for C and C++ to insert memory safety checks. These catch the underlying overflow or invalid write before it becomes an exploit.

Because write-what-where comes from earlier bugs, fuzzing the parsers that feed it, especially file format and image parsers, is the practical way to reach it.

How to fix it

The record has no mitigation list. Since the weakness is an outcome, fix the causes.

• Eliminate the buffer overflows and integer overflows that give attackers control over pointers and offsets.
• Validate sizes and dimensions from untrusted files before use, including image width, height and channel counts.
• Keep function pointers and critical flags away from buffers that hold external data.
• Limit resources an input may use, such as memory and band counts.
• Build with the memory protections your platform offers, and treat them as a second line of defense.

Quick check

Sources

• MITRE CWE-123
• Safeguard Gold entry for CWE-123