CWE-1260 is the weakness of a hardware design that allows address regions to overlap, which can bypass intended memory protection. It matters to designers of memory protection units (MPUs) and to firmware teams who program them.
How it happens
Hardware protects privileged software with isolated memory regions and read and write policies. Software is often allowed to change or remap region definitions so memory management stays flexible.
That flexibility is the risk. If lower privilege software can program a region so it overlaps memory used by higher privilege software, it may be able to escalate privileges. The MPU logic can handle the overlap wrongly and let the lower privilege software read or write the protected range. An overlap can also be used to attack the availability of the higher privilege regions.
MITRE's example is a design with 16 bit addresses and two privilege levels, with three programmable regions. A filter checks each request against all three regions and grants access only if all three allow it. The designer intends regions 0 and 1 to be programmable by privileged software and region 2 by non-privileged software. The risk is a non-privileged program defining region 2 so it overlaps the privileged ones.
The record also lists CVE-2008-7096, a virtualization product that allows compromise of the hardware through certain remapping registers (Gold page), and a processor design flaw where ring 0 code reaches more privileged rings by making a register window overlap protected system RAM.
What an attacker gains
The record lists high impact on confidentiality, integrity and availability: reading and modifying memory and causing instability.
How to find it
MITRE gives a manual test rated high in effectiveness. Create a high privilege memory block of any size. Then try to create a lower privilege block that overlaps it. If the attempt works, fix the hardware and repeat the test.
How to fix it
MITRE's mitigations:
- Make sure regions are isolated as intended and that the hardware uses access control policies to protect privileged software.
- Define a priority scheme among programmable regions. For example, with Region_0, Region_1 and Region_2, an address in several regions follows the policy of the lowest numbered one. Some designs let trusted software program the priority scheme.
- Have hardware logic or trusted firmware check region definitions and block programming of overlapping regions.
- Or apply the policy of every overlapping region, so an address in both Region_0 and Region_1 is accessible only if both policies allow it.
MITRE rates this high in effectiveness.
Quick check
What is the simplest overlap test?
Create a high privilege region, then try to create an overlapping lower privilege region. If it succeeds, the hardware is vulnerable.
How can the filter treat overlaps safely?
By granting access only if all overlapping regions' policies allow it, or by having a priority scheme such as lowest region ID wins.
