CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations

Extended Description

CPUs provide a special bit that supports exclusivity of write and execute operations. This bit is used to segregate areas of memory to either mark them as code (instructions, which can be executed) or data (which should not be executed). In this way, if a user can write to a region of memory, the user cannot execute from that region and vice versa. This exclusivity provided by special hardware bit is leveraged by the operating system to protect executable space. While this bit is available in most modern processors by default, in some CPUs the exclusivity is implemented via a memory-protection unit (MPU) and memory-management unit (MMU) in which memory regions can be carved out with exact read, write, and execute permissions. However, if the CPU does not have an MMU/MPU, then there is no write exclusivity.

Code Examples & CVEs

Demonstrative Examples

MCS51 Microcontroller (based on 8051) does not have a special bit to support write exclusivity. It also does not have an MMU/MPU support. The Cortex-M CPU has an optional MPU that supports up to 8 regions.

If the MPU is not configured, then an attacker will be able to inject malicious data into memory and execute it.

BadOther

The optional MPU is not configured.

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-1252 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-1252, CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations during Architecture and Design

MITRE associates mitigation with Architecture and Design, and Integration; recorded impacts include Execute Unauthorized Code or Commands; the entry maps to CAPEC-679. Use these source-defined anchors to turn CWE-1252 into implementation, review, and verification checks for the affected component.

CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations — MITRE CWE

Triage CWE-1252 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-1252, CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-1252

Apply MITRE's full root-cause mapping guidance when using CWE-1252, CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-1252 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-1252, CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations?+

CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The CPU is not configured to provide hardware support for exclusivity of write and execute operations on memory. This allows an attacker to execute data from all of memory. CPUs provide a special bit that supports exclusivity of write and execute operations. This bit is used to segregate areas of memory to either mark them as code (instructions, which can be executed) or data (which should not be executed). In this way, if a user can write to a region of memory, the user cannot execute from that region and vice versa. This exclusivity provided by special hardware bit is leveraged by the operating system to protect executable space. While this bit is available in most modern processors by default, in some CPUs the exclusivity is implemented via a memory-protection unit (MPU) and memory-management unit (MMU) in which memory regions can be carved out with exact read, write, and execute permissions. However, if the CPU does not have an MMU/MPU, then there is no write exclusivity.

What are the security consequences of CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations?+

If exploited, CWE-1252 (CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations) it can compromise Confidentiality and Integrity, leading to outcomes such as Execute Unauthorized Code or Commands.

How do you prevent or mitigate CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations?+

Recommended mitigations for CWE-1252 include: Implement a dedicated bit that can be leveraged by the Operating System to mark data areas as non-executable. If such a bit is not available in the CPU, implement MMU/MPU (memory management unit / memory protection unit). If MMU/MPU are not available, then the firewalls need to be implemented in the SoC interconnect to mimic the write-exclusivity operation.

Which programming languages are affected by CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations?+

CWE-1252 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-1252 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description