CWE-1252 covers a CPU that is not configured to enforce write and execute exclusivity on memory. The result is that an attacker can execute data from anywhere in memory. It applies to embedded and microcontroller designs in particular, where this hardware protection may not exist or may be left switched off.
How it happens
Most modern CPUs have a bit that splits memory into code, which can be executed, and data, which cannot. If you can write to a region, you cannot execute from it, and the reverse. The operating system uses this to protect executable space.
Some CPUs do the same job with a memory protection unit (MPU) and memory management unit (MMU), where regions are carved out with exact read, write and execute permissions. A CPU with neither has no write exclusivity at all.
MITRE gives a concrete comparison. An MCS51 microcontroller, based on the 8051, has no special bit for write exclusivity and no MMU or MPU. A Cortex-M CPU has an optional MPU that supports up to 8 regions. The problem there is that the MPU is optional, and if nobody configures it, an attacker can inject malicious data into memory and execute it.
What an attacker gains
The record lists confidentiality and integrity, and executing unauthorized code or commands. With no separation between writable and executable memory, any bug that lets an attacker write bytes becomes a way to run them. Without exclusivity, an attacker may inject malicious code into memory and later execute it.
How to find it
No detection methods are listed. For a design review:
- Check whether the CPU has a no-execute bit, or an MMU or MPU.
- If an MPU is present, confirm that it is configured and that the regions it defines match the intended code and data layout.
- Look for any region that is both writable and executable.
How to fix it
MITRE gives layered options.
- At design, implement a dedicated bit the operating system can use to mark data areas non-executable.
- If the CPU has no such bit, implement an MMU or MPU.
- At integration, if neither is available, implement firewalls in the SoC interconnect to mimic write exclusivity.
Quick check
Is having an MPU enough?
No. MITRE's example notes that an MPU that exists but is not configured gives no protection, and an attacker can still inject and run code.
What if the CPU has neither a no-execute bit nor an MMU or MPU?
Use firewalls in the SoC interconnect to mimic the write-exclusivity operation, as MITRE recommends at integration.
