Write-what-where Condition

Description

Write-what-where Condition is a vulnerability where an attacker can write an arbitrary value to an arbitrary memory location. This powerful exploitation primitive typically results from buffer overflows, format string vulnerabilities, or other memory corruption bugs that provide attackers with control over both the write address and the value written. When attackers achieve write-what-where capability, they can overwrite any writable memory including function pointers, GOT entries, return addresses, or security-critical variables. This vulnerability class represents one of the most dangerous exploitation primitives available.

Risk

Write-what-where conditions are extremely dangerous because they provide attackers with direct, arbitrary memory write capability. A single write-what-where primitive can be leveraged to achieve code execution through various techniques: overwriting GOT entries to redirect function calls, corrupting function pointers, modifying security flags, or installing hooks in critical code paths. Modern exploits often chain weaker vulnerabilities to achieve write-what-where capability as an intermediate step toward full control. The vulnerability affects software across all platforms including operating systems, browsers, hardware firmware, and embedded devices.

Solution

Eliminate the underlying vulnerabilities that enable write-what-where conditions: fix buffer overflows, format string bugs, and integer overflows. Implement memory-safe programming practices with bounds checking on all write operations. Use compiler protections: ASLR to randomize memory layout, stack canaries, Control Flow Integrity (CFI), and write-protected memory regions. Enable hardware protections like Intel CET (Control-flow Enforcement Technology). Use memory-safe languages (Rust, Go) for new development. Conduct thorough code audits focusing on pointer arithmetic and array indexing.

Common Consequences

Impact	Details
Access Control	Scope: Code Execution Arbitrary write enables overwriting function pointers, GOT entries, or return addresses to hijack execution flow.
Integrity	Scope: Integrity Any writable memory can be modified, including security-critical variables, configuration data, or heap metadata.
Confidentiality	Scope: Confidentiality Write primitives can be chained with read primitives to leak sensitive data or bypass ASLR.

Example Code + Solution Code

Vulnerable Code

#include <string.h>

// VULNERABLE: Write-what-where via controlled index
void write_log_entry(int *log_buffer, int index, int value) {
    // Attacker controls index - can write anywhere relative to log_buffer
    log_buffer[index] = value;  // Write-what-where if index not validated
}

// VULNERABLE: Format string providing write-what-where
void log_message(char *user_input) {
    // %n writes number of bytes printed to address on stack
    // Attacker can use format specifiers to achieve arbitrary write
    printf(user_input);  // Write-what-where via %n format specifier
}

// VULNERABLE: Heap metadata corruption
void heap_overflow_www(char *user_data, size_t len) {
    char *buf = malloc(32);
    memcpy(buf, user_data, len);  // Overflow corrupts heap metadata
    free(buf);  // Unlink operation provides write-what-where
}

Fixed Code

#include <string.h>
#include <stdio.h>
#include <stdint.h>

// SAFE: Bounds-checked array write
int write_log_entry_safe(int *log_buffer, size_t buffer_size, size_t index, int value) {
    // Validate index is within bounds
    if (index >= buffer_size) {
        return -1;  // Reject out-of-bounds write
    }
    log_buffer[index] = value;
    return 0;
}

// SAFE: Never use user input as format string
void log_message_safe(const char *user_input) {
    // Use format specifier - user input cannot inject %n
    printf("%s", user_input);
}

// SAFE: Bounds-checked heap copy
void heap_copy_safe(const char *user_data, size_t len) {
    const size_t BUFFER_SIZE = 32;

    if (len > BUFFER_SIZE) {
        len = BUFFER_SIZE;  // Truncate to buffer size
    }

    char *buf = malloc(BUFFER_SIZE);
    if (!buf) return;

    memcpy(buf, user_data, len);
    // Use buffer...
    free(buf);
}

---

Exploited in the Wild

GhostWrite CPU Vulnerability (T-Head RISC-V, 2024)

The T-Head XuanTie C910 and C920 RISC-V CPUs contain instructions that allow unprivileged attackers to write to arbitrary physical memory locations. This hardware vulnerability enables complete system compromise from userspace.

• https://ghostwriteattack.com/

VMware ESXi Sandbox Escape (VMware, 2024)

CVE-2024-22252 is an arbitrary write vulnerability in VMware ESXi where a malicious actor with VMX process privileges can trigger an arbitrary kernel write, leading to VM escape.

• https://www.vmware.com/security/advisories/

Adobe Substance3D Multiple WWW (Adobe, 2024)

Multiple Adobe Substance3D products (Painter, Stager) contained write-what-where vulnerabilities enabling arbitrary code execution through malicious files.

• https://helpx.adobe.com/security.html

---

Tools to test/exploit

• pwntools — CTF framework with utilities for building write-what-where exploits.

• ROPgadget — find gadgets for chaining with write primitives.

• one_gadget — find single-shot gadgets for exploitation after achieving write-what-where.

---

CVE Examples

• CVE-2024-22252 — VMware ESXi arbitrary write enabling VM escape.

• CVE-2024-41867 — Adobe Substance3D Stager write-what-where vulnerability.

• CVE-2024-20767 — Adobe ColdFusion arbitrary write vulnerability.

---

References

1. MITRE. "CWE-123: Write-what-where Condition." https://cwe.mitre.org/data/definitions/123.html

2. Phrack. "Advanced Doug Lea's malloc exploits." http://phrack.org/issues/61/6.html