CWE-587 describes code that sets a pointer to a specific address other than NULL or 0. It is a memory-unsafe pattern, so it lives in C, C++, C#, and assembly code, and most often in low-level work such as drivers, firmware, and embedded software.
MITRE's note is short: a fixed address is not portable, because it will probably not be valid on every environment or platform.
How it happens
A developer knows that a device register, a shared buffer, or a helper routine sat at a particular address on the board in front of them. So they write it down as a constant.
/* Vulnerable pattern: a literal address used as a pointer */
volatile unsigned int *status = (unsigned int *)0x7ffe0010;
*status = 1;
On the original hardware this may work for years. Move the code to another platform, another OS version, or a build with address randomization, and that address now points at something else, or at nothing.
What an attacker gains
The consequences in the record cover three outcomes.
- Code execution. If code runs from a known location, an attacker may be able to inject code there beforehand.
- Memory exposure. Data at a known pointer location can be easily read or influenced by an attacker.
- Crashes. If the code is ported, the pointer is likely invalid, which causes a crash and hurts reliability and maintainability.
How to find it
Static analysis (SAST) can find some instances by modelling how values flow to pointers. A literal integer cast to a pointer type is the shape to search for. During testing, compile-time memory checking such as AddressSanitizer for C and C++ can surface the resulting bad accesses, though crafted inputs are needed to reach the code.
How to fix it
MITRE's guidance is direct: never set a pointer to a fixed address.
- Ask the platform for memory or for the device mapping instead of assuming a location.
- Take addresses from linker symbols, configuration, or a documented API.
- When hardware really requires a fixed register address, keep it in one named, per-platform header so a port changes it in one place and reviewers can see it.
/* Better: memory comes from the allocator, not a guess */
unsigned int *status = malloc(sizeof *status);
if (status == NULL) { return -1; }
*status = 1;
Quick check
Is a pointer set to NULL covered by this weakness?
No. The definition covers pointers set to a specific address other than NULL or 0.
Why is a fixed address a portability problem?
That address will probably not be valid in all environments or platforms, so a ported build may crash or touch the wrong memory.
