What is Assignment of a Fixed Address (CWE-587)?

TL;DR: Assignment of a Fixed Address to a Pointer (CWE-587) is an issue where pointers are set to specific addresses, leading to undefined behavior and security vulnerabilities. It can cause data corruption, unauthorized code execution, crashes, and reduced maintainability. The fix involves never assigning a pointer to a fixed address other than NULL or 0.

What is Assignment of a Fixed Address to a Pointer?

Assignment of a Fixed Address to a Pointer (CWE-587) is a type of vulnerability where the product sets a pointer to a specific address other than NULL or 0. As defined by the MITRE Corporation under CWE-587, and classified by the OWASP Foundation as not directly mapped.

Quick Summary

Assignment of a Fixed Address to a Pointer poses significant risks due to undefined behavior leading to data corruption, unauthorized code execution, crashes, reduced maintainability, and decreased reliability. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes

Jump to: Quick Summary · Assignment of a Fixed Address to a Pointer Overview · How Assignment of a Fixed Address to a Pointer Works · Business Impact of Assignment of a Fixed Address to a Pointer · Assignment of a Fixed Address to a Pointer Attack Scenario · How to Detect Assignment of a Fixed Address to a Pointer · How to Fix Assignment of a Fixed Address to a Pointer · Framework-Specific Fixes for Assignment of a Fixed Address to a Pointer · How to Ask AI to Check Your Code for Assignment of a Fixed Address to a Pointer · Assignment of a Fixed Address to a Pointer Best Practices Checklist · Assignment of a Fixed Address to a Pointer FAQ · Vulnerabilities Related to Assignment of a Fixed Address to a Pointer · References · Scan Your Own Site

Assignment of a Fixed Address to a Pointer Overview

What

Assignment of a Fixed Address to a Pointer is the practice of setting pointers to specific addresses other than NULL or 0.

Why it matters

This leads to undefined behavior, potential data corruption, and security vulnerabilities such as unauthorized code execution and crashes.

Where it occurs

It commonly occurs in C/C++ applications where memory management is directly controlled by developers.

Who is affected

Developers and organizations using C/C++ for system-level programming or low-level application development are at risk.

Who is NOT affected

Applications written in higher-level languages like Python, Java, or JavaScript that abstract away direct pointer manipulation do not face this issue.

How Assignment of a Fixed Address to a Pointer Works

Root Cause

The root cause lies in setting pointers to specific addresses without proper validation or context checks.

Attack Flow

1. An attacker identifies the fixed address assigned to a pointer.
2. The attacker manipulates memory at that location, leading to unexpected behavior.
3. This can result in unauthorized code execution or data corruption.

Prerequisites to Exploit

• The application must set pointers to specific addresses.
• The attacker needs to know these addresses and manipulate them accordingly.

Vulnerable Code

int* ptr = (int*)0x12345678;

This code sets a pointer ptr to a fixed address, leading to undefined behavior if the memory at that location is not properly managed or validated.

Secure Code

int value = 0;
int* ptr = &value;

The secure version initializes pointers with safe values and avoids setting them to specific addresses without proper validation.

Business Impact of Assignment of a Fixed Address to a Pointer

Confidentiality

• Exposed data: If an attacker manipulates memory at the fixed address, sensitive information can be compromised.
• Example scenario: An attacker reads or modifies confidential data stored in memory.

Integrity

• Data corruption: Unauthorized changes to memory contents can corrupt application state and data integrity.
• Example scenario: A pointer pointing to a critical variable is manipulated, leading to incorrect program behavior.

Availability

• Crashes and instability: Setting pointers to fixed addresses without validation leads to crashes or unstable system states.
• Example scenario: The application crashes due to invalid memory access at the fixed address.

Business Consequences:

1. Financial loss from downtime and recovery efforts.
2. Compliance penalties for data breaches.
3. Reputational damage due to security incidents.

Assignment of a Fixed Address to a Pointer Attack Scenario

1. An attacker identifies that a pointer is set to a specific address in the application’s memory.
2. The attacker manipulates the contents at this address, leading to unexpected behavior.
3. This manipulation causes data corruption or unauthorized code execution.
4. The application crashes or behaves unpredictably due to invalid memory access.

How to Detect Assignment of a Fixed Address to a Pointer

Manual Testing

• Review code for instances where pointers are set to specific addresses.
• Check if these assignments are validated and context-appropriate.
• Verify that the fixed address is not used in ways that can lead to undefined behavior.

Automated Scanners (SAST/DAST)

Static analysis tools can detect patterns of setting pointers to fixed addresses, while dynamic testing verifies actual runtime behavior.

PenScan Detection

PenScan’s scanner engines such as ZAP and Nuclei can identify code patterns indicative of this vulnerability.

False Positive Guidance

A false positive occurs when a pointer is set to a fixed address but the application ensures proper validation and context checks.

How to Fix Assignment of a Fixed Address to a Pointer

• Never assign pointers to specific addresses other than NULL or 0.
• Initialize pointers with safe values and avoid setting them to fixed addresses without validation.
• Ensure that memory operations are validated and context-appropriate to prevent undefined behavior.

Framework-Specific Fixes for Assignment of a Fixed Address to a Pointer

int value = 0;
int* ptr = &value;

This C++ example demonstrates initializing pointers with safe values, avoiding fixed address assignments.

How to Ask AI to Check Your Code for Assignment of a Fixed Address to a Pointer

Assignment of a Fixed Address to a Pointer Best Practices Checklist

✅ Never assign pointers to specific addresses other than NULL or 0. ✅ Initialize pointers with safe values and avoid fixed address assignments without validation. ✅ Ensure memory operations are validated and context-appropriate. ✅ Use static analysis tools for code review. ✅ Verify runtime behavior through dynamic testing.

Assignment of a Fixed Address to a Pointer FAQ

How does Assignment of a Fixed Address to a Pointer occur in code?

It occurs when a pointer is set to a specific address other than NULL or 0, leading to undefined behavior and potential security risks.

What are the consequences of Assignment of a Fixed Address to a Pointer?

This can lead to unauthorized code execution, data corruption, crashes, reduced maintainability, and decreased reliability.

How do attackers exploit Assignment of a Fixed Address to a Pointer?

Attackers might inject malicious code at a known location or manipulate memory contents, causing the application to behave unpredictably.

Can you provide an example of vulnerable code for Assignment of a Fixed Address to a Pointer?

A pointer is assigned a fixed address without proper validation or context checks, such as ptr = (int*)0x12345678;.

How can I detect Assignment of a Fixed Address to a Pointer in my codebase?

Use static analysis tools and manual code reviews to identify instances where pointers are assigned fixed addresses.

What is the best way to fix Assignment of a Fixed Address to a Pointer?

description: Never set a pointer to a fixed address. Ensure that pointers are dynamically allocated or initialized with safe values.

How does PenScan help in detecting Assignment of a Fixed Address to a Pointer?

PenScan’s automated scanners can identify code patterns indicative of this vulnerability and flag them for review.

Vulnerabilities Related to Assignment of a Fixed Address to a Pointer

References

• MITRE: Assignment of a Fixed Address to a Pointer
• NVD: National Vulnerability Database

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Assignment of a Fixed Address to a Pointer and other risks before an attacker does.