Detail CWE-190

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Mode Pengenalan

Implementation : This weakness may become security-critical when determining the offset or size in behaviors such as memory allocation, copying, and concatenation.
Implementation : This weakness may become security-critical when a security decision is based on time, and the time field is subject to an integer overflow.

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)
Nama: C (Often)
Nama: Python (Undetermined)

Teknologi

Kelas: Not Technology-Specific (Undetermined)

Konsekuensi Umum

Contoh yang Diamati

Mitigasi yang Memungkinkan

Phases : Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
Phases : Requirements
Phases : Architecture and Design
Phases : Implementation
Phases : Implementation
Phases : Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Phases : Implementation
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.

Metode Deteksi

Automated Static Analysis

This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives.
Efektivitas : High

Black Box

Sometimes, evidence of this weakness can be detected using dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Efektivitas : Moderate

Manual Analysis

Efektivitas : High

Automated Static Analysis - Binary or Bytecode

Efektivitas : High

Dynamic Analysis with Manual Results Interpretation

Efektivitas : SOAR Partial

Manual Static Analysis - Source Code

Efektivitas : SOAR Partial

Automated Static Analysis - Source Code

Efektivitas : High

Architecture or Design Review

Efektivitas : High

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentar : Be careful of terminology problems with "overflow," "underflow," and "wraparound" - see Terminology Notes. Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Pola Serangan Terkait

Catatan

Integer overflows can be primary to buffer overflows when they cause less memory to be allocated than expected.

While there may be circumstances in which the logic intentionally relies on wrapping - such as with modular arithmetic in timers or counters - it can have security consequences if the wrap is unexpected. This is especially the case if the integer overflow can be triggered using user-supplied inputs.
It could be considered by some stakeholders that some time-based overflows would not count as weaknesses or vulnerabilities, especially if there is no influence from an adversary. However, CWE allows for cases in which physical phenomena and measurements can contribute to insecure states, and temporal phenomena - which are outside the direct control of the product - also apply.

Referensi

REF-145

An overview of common programming security vulnerabilities and possible solutions
Yves Younan.
https://fort-knox.org/thesis.pdf

REF-146

Basic Integer Overflows
blexim.
https://phrack.org/issues/60/10

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

REF-106

SafeInt
David LeBlanc, Niels Dekker.
https://github.com/dcleblanc/SafeInt/

REF-150

Top 25 Series - Rank 17 - Integer Overflow Or Wraparound
Johannes Ullrich.
http://software-security.sans.org/blog/2010/03/18/top-25-series-rank-17-integer-overflow-or-wraparound

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

REF-1440

Integer overflow
https://en.wikipedia.org/wiki/Integer_overflow

REF-1479

State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx

REF-1482

D3FEND: D3-TL Trusted Library
D3FEND.
https://d3fend.mitre.org/technique/d3f:TrustedLibrary/

REF-1541

Secure Coding Guide for Python
OpenSSF.
https://best.openssf.org/Secure-Coding-Guide-for-Python/

REF-1550

Secure PLC Coding Practices: Top 20 List
Secure PLC Programming project.
https://plc-security.com/

REF-1570

The Y2K38 Bug Is a Vulnerability, Not Just a Date Problem, Researchers Warn
Eduard Kovacs.
https://www.securityweek.com/the-y2k38-bug-is-a-vulnerability-not-just-a-date-problem-researchers-warn/

REF-1571

Year 2038 problem
Wikipedia.
https://en.wikipedia.org/wiki/Year_2038_problem

Pengajuan

Modifikasi