Sensitive Data Storage in Improperly Locked Memory
CWE-591
The product stores sensitive data in memory that is not locked, or that has been incorrectly locked.
We track 4 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.2. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Identify data that needs to be protected from swapping and choose platform-appropriate protection mechanisms.
- Implementation: When using potentially risky functions such as mlock() or VirtualLock(), check return values to ensure that locking operations are successful.
Latest Sensitive Data Storage in Improperly Locked Memory vulnerabilities
- 7.1 High severity
Windows 10 Version 1507: Sensitive Data Storage in Improperly Locked Memory
Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over an adjacent network.
- 7.5 High severity
Windows 10 Version 1507: Sensitive Data Storage in Improperly Locked Memory
Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges over a network.
- 7.0 High severity
Microsoft Windows Kernel Privilege Escalation Exploited
Windows Kernel Elevation of Privilege Vulnerability
- 7.0 High severity
Microsoft Windows CNG Key Isolation Service Privilege Escalation Exploited
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability