Improper Write Handling in Limited-write Non-Volatile Memories

Incomplete Base
Structure: Simple
Description

This vulnerability occurs when a system fails to properly manage write operations on memory hardware that has a limited lifespan, such as Flash or EEPROM. Without correct wear leveling, specific memory cells wear out faster than intended, leading to premature device failure.

Extended Description

Many non-volatile memory chips, like NAND Flash and EEPROM, have a fundamental physical limitation: each memory cell can only be written to or erased a finite number of times. To maximize the overall lifespan of the storage device, a technique called wear leveling is essential. It works by dynamically mapping the system's logical write requests across different physical memory blocks, ensuring that write cycles are distributed evenly instead of repeatedly hitting the same cells. If wear leveling is missing or implemented incorrectly, it creates a critical weakness. An attacker can exploit this by deliberately targeting the same logical addresses with frequent write operations. This causes the underlying physical cells to wear out rapidly, potentially bricking the storage device or making data unreliable far sooner than its rated endurance, which constitutes a denial-of-service attack against the hardware itself.

Common Consequences 1
Scope: Availability

Impact: DoS: Instability

Potential Mitigations 1
Phase: Architecture and DesignImplementationTesting
Include secure wear leveling algorithms and ensure they may not be bypassed.

Effectiveness: High

Demonstrative Examples 1
An attacker can render a memory line unusable by repeatedly causing a write to the memory line.
Below is example code from [REF-1058] that the user can execute repeatedly to cause line failure. W is the maximum associativity of any cache in the system; S is the size of the largest cache in the system.

Code Example:

Attack
C++

// Do aligned alloc of (W+1) arrays each of size S while(1) {

c++
Without wear leveling, the above attack will be successful. Simple randomization of blocks will not suffice as instead of the original physical block, the randomized physical block will be worn out.

Code Example:

Good
Other
other
References 2
Enhancing Lifetime and Security of PCM-Based Main Memory with Start-Gap Wear Leveling
Moinuddin Qureshi, Michele Franchescini, Vijayalakshmi Srinivasan, Luis Lastras, Bulent Abali, and John Karidis
ID: REF-1058
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Technologies:
System on Chip : UndeterminedMemory Hardware : UndeterminedStorage Hardware : Undetermined
Modes of Introduction
Architecture and Design
Implementation
Related Weaknesses
Taxonomy Mapping
  • ISA/IEC 62443
  • ISA/IEC 62443
  • ISA/IEC 62443