Improper Access Control for Volatile Memory Containing Boot Code
CWE-1274
The product conducts a secure-boot process that transfers bootloader code from Non-Volatile Memory (NVM) into Volatile Memory (VM), but it does not have sufficient access control or other protections for the Volatile Memory.
We track 4 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.8.
How this weakness is prevented
- Architecture and Design: Ensure that the design of volatile-memory protections is enough to prevent modification from an adversary or untrusted code.
- Testing: Test the volatile-memory protections to ensure they are safe from modification or untrusted code.
Latest Improper Access Control for Volatile Memory Containing Boot Code vulnerabilities
- 7.1 High severity
AMD EPYC™ 9004 Series Processors: Improper Access Control for Volatile Memory Containing Boot Code
Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution.
- 7.5 High severity
Bravo Compute Box Firmware: Improper Access Control for Volatile Memory Containing Boot Code
Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with its bootloader unlocked. This permits bypass of Android Verified Boot (AVB) and allows direct modification of partitions.
- 7.8 High severity
ASIK AirScale: Improper Access Control for Volatile Memory Containing Boot Code
The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware. This could result in the execution of a malicious kernel, arbitrary programs, or modified Nokia programs.
- 8.8 High severity
ASIK AirScale: Improper Access Control for Volatile Memory Containing Boot Code
A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place a script on the file system accessible from Linux. A script placed in the appropriate place could allow for arbitrary cod