Non-volatile memories such as NAND Flash, EEPROM, etc. have individually erasable segments, each of which can be put through a limited number of program/erase or write cycles. For example, the device can only endure a limited number of writes, after which the device becomes unreliable. In order to wear out the cells in a uniform manner, non-volatile memory and storage products based on the above-mentioned technologies implement a technique called wear leveling. Once a set threshold is reached, wear leveling maps writes of a logical block to a different physical block. This prevents a single physical block from prematurely failing due to a high concentration of writes. If wear leveling is improperly implemented, attackers may be able to programmatically cause the storage to become unreliable within a much shorter time than would normally be expected.
| Impact | Details |
|---|---|
|
DoS: Instability |
Scope: Availability |
| Phase(s) | Mitigation |
|---|---|
|
Architecture and Design; Implementation; Testing |
Include secure wear leveling algorithms and ensure they may not be bypassed.
Effectiveness: High |
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 400 | Uncontrolled Resource Consumption |
| Nature | Type | ID | Name |
|---|---|---|---|
| MemberOf | Category Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1202 | Memory and Storage Issues |
| Phase | Note |
|---|---|
| Architecture and Design | |
| Implementation |
Class: Not Language-Specific (Undetermined Prevalence)
Class: Not OS-Specific (Undetermined Prevalence)
Class: Not Architecture-Specific (Undetermined Prevalence)
Class: System on Chip (Undetermined Prevalence)
Memory Hardware (Undetermined Prevalence)
Storage Hardware (Undetermined Prevalence)
Example 1
An attacker can render a memory line unusable by repeatedly causing a write to the memory line.
Below is example code from [REF-1058] that the user can execute repeatedly to cause line failure. W is the maximum associativity of any cache in the system; S is the size of the largest cache in the system.
Without wear leveling, the above attack will be successful. Simple randomization of blocks will not suffice as instead of the original physical block, the randomized physical block will be worn out.
| Nature | Type | ID | Name |
|---|---|---|---|
| MemberOf | CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. | 1416 | Comprehensive Categorization: Resource Lifecycle Management |
Rationale
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Comments
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.| Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
|---|---|---|---|
| ISA/IEC 62443 | Part 4-1 | Req SD-4 | |
| ISA/IEC 62443 | Part 4-1 | Req SI-1 | |
| ISA/IEC 62443 | Part 4-1 | Req SVV-3 |
| CAPEC-ID | Attack Pattern Name |
|---|---|
| CAPEC-212 | Functionality Misuse |
| Submissions | ||
|---|---|---|
| Submission Date | Submitter | Organization |
|
2020年02月10日
(CWE 4.0, 2020年02月24日) |
Arun Kanuparthi, Hareesh Khattri, Parbati Kumar Manna, Narasimha Kumar V Mangipudi | Intel Corporation |
| Contributions | ||
| Contribution Date | Contributor | Organization |
| 2023年04月25日 | "Mapping CWE to 62443" Sub-Working Group | CWE-CAPEC ICS/OT SIG |
| Suggested mappings to ISA/IEC 62443. | ||
| 2024年04月23日 | James Lang | LDRA |
| Suggested fix for broken 404 reference URL. | ||
| Modifications | ||
| Modification Date | Modifier | Organization |
|
2025年09月09日
(CWE 4.18, 2025年09月09日) |
CWE Content Team | MITRE |
| updated References | ||
|
2025年04月03日
(CWE 4.17, 2025年04月03日) |
CWE Content Team | MITRE |
| updated Demonstrative_Examples, References | ||
| 2023年06月29日 | CWE Content Team | MITRE |
| updated Mapping_Notes | ||
| 2023年04月27日 | CWE Content Team | MITRE |
| updated References, Relationships, Taxonomy_Mappings | ||
| 2022年10月13日 | CWE Content Team | MITRE |
| updated Demonstrative_Examples, Relationships, Research_Gaps | ||
| 2022年06月28日 | CWE Content Team | MITRE |
| updated Applicable_Platforms | ||
| 2022年04月28日 | CWE Content Team | MITRE |
| updated Applicable_Platforms | ||
| 2021年07月20日 | CWE Content Team | MITRE |
| updated Related_Attack_Patterns | ||
| 2020年08月20日 | CWE Content Team | MITRE |
| updated Demonstrative_Examples, Description, Potential_Mitigations, Research_Gaps | ||
Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2025, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.