Detail CWE-1038

CWE-1038

Insecure Automated Optimizations
2018-03-29
00h00 +00:00
Rendah
Draft
2026-10-28
00h00 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Insecure Automated Optimizations

The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.

Informasi Umum

Mode Pengenalan

Architecture and Design : Optimizations built into the design of a product can have unintended consequences during execution.

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Konsekuensi Umum

Cakupan Dampak Kemungkinan
IntegrityAlter Execution Logic

Catatan: The optimizations alter the order of execution resulting in side effects that were not intended by the original developer.

Contoh yang Diamati

Referensi Deskripsi

CVE-2017-5715

Intel, ARM, and AMD processor optimizations related to speculative execution and branch prediction cause access control checks to be bypassed when placing data into the cache. Often known as "Spectre".

CVE-2008-1685

C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is a Class and might have Base-level children that would be more appropriate
Komentar : Examine children of this entry to see if there is a better fit

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
CWE Content Team MITRE 2018-03-07 +00:00 2018-03-29 +00:00 3.1

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2020-02-24 +00:00 updated Relationships
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2023-10-26 +00:00 updated Observed_Examples
CWE Content Team MITRE 2025-12-11 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2026-10-28 +00:00 updated Dimensions
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.