VNX-587: Assignment of a Fixed Address to a Pointer
Reports an integer literal of 0x1000 or above cast to a pointer and assigned, returned or bound by #define in C and C++. Null and sentinel values, poison patterns, integer casts, comparisons and test files are not reported.
| Field | Value |
|---|---|
| Rule ID | VNX-587 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | C, C++ |
| CWE | CWE-587 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | assigning-fixed-address cwe-587 |
| Source | internal/sast/rules/vnx-587.rego |
Overview
VNX-587 maps to CWE-587: Assignment of a Fixed Address to a Pointer. It reports a cast of an integer literal to a pointer type (C casts and reinterpret_cast) that is assigned to a pointer, returned, or bound by a #define, including a cast whose literal is on the next line.
Why This Matters
A hard-coded address ties the program to one memory layout. When the layout changes (another board revision, ASLR, a different loader), the pointer refers to unrelated or unmapped memory, which corrupts data or crashes, and a predictable address helps an attacker.
What Gets Flagged
int *p = (int *)0x8000;
reg = (uint8_t *)0xFFFF0000u;
#define UART0_DR (*(volatile unsigned int *)0x4000C000)auto *ctrl = reinterpret_cast<std::uint32_t *>(0x1F000000);Not flagged: (void *)0, (char *)-1, (void *)0x100 and other values below the first page, 0xFFFFFFFF, poison values such as 0xdeadbeef, (uintptr_t)0x40020000, (uint32_t *)(base + 0x4000), child == (void *)0x40020000, casts passed as arguments, comments, strings and test files.
Remediation
- Take device addresses from the platform’s headers, linker map or device tree rather than literals scattered through the code.
- On hosted systems, obtain memory from
mmap()or the allocator and never assume an absolute address.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-587
// nosec vnx-587Or record an ignore rule: vulnetix ignore add --rule vnx-587 --reason "...". See Suppressing findings.