CWE-781Variant

Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code

Draft in the CWE catalog · 0 CVEs mapped

0

CVEs mapped

What it is

The product defines an IOCTL that uses METHOD_NEITHER for I/O, but it does not validate or incorrectly validates the addresses that are provided.

The record

Technical detail

CWE ID: CWE-781
Abstraction: Variant
Structure: Simple
Status: Draft

References (7)

http://reversemode.com/index.php?option=com_content&task=view&id=38&Itemid=1 https://www.blackhat.com/presentations/bh-usa-07/Bulygin/Presentation/bh-usa-07-bulygin.pdf http://www.net-security.org/dl/insecure/INSECURE-Mag-18.pdf https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/buffer-descriptions-for-i-o-control-codes https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/using-neither-buffered-nor-direct-i-o https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/controlling-device-access https://www.piotrbania.com/all/articles/ewdd.pdf