名前: Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
一般情報
導入モード
Implementation適用可能なプラットフォーム
言語
クラス： Not Language-Specific (Undetermined)テクノロジー
クラス： Not Technology-Specific (Undetermined)一般的な結果
| スコープ | 影響 | 可能性 |
|---|---|---|
| Availability | DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Amplification, DoS: Crash, Exit, or Restart 注記：Excessive looping will cause unexpected consumption of resources, such as CPU cycles or memory. The product's operation may slow down, or cause a long time to respond. If limited resources such as memory are consumed for each iteration, the loop may eventually cause a crash or program exit due to exhaustion of resources, such as an out-of-memory error. In many cases, a loop does not need to be infinite in order to cause enough resource consumption to adversely affect the product or its host system; it depends on the amount of resources consumed per iteration. |
観察された例
| 参考文献 | 説明 |
|---|---|
CVE-2011-1027 | Chain: off-by-one error (CWE-193) leads to infinite loop (CWE-835) using invalid hex-encoded characters. |
CVE-2006-6499 | Chain: web browser crashes due to infinite loop - "bad looping logic [that relies on] floating point math [CWE-1339] to exit the loop [CWE-835]" |
検出方法
Dynamic Analysis with Manual Results Interpretation
有効性 : SOAR PartialManual Static Analysis - Source Code
有効性 : SOAR PartialAutomated Static Analysis - Source Code
有効性 : HighArchitecture or Design Review
有効性 : High脆弱性マッピングノート
理由 : This CWE entry is a level-1 Class (i.e., a child of a Pillar). It might have lower-level children that would be more appropriateコメント : Examine children of this entry to see if there is a better fit
参考文献
REF-62
The Art of Software Security AssessmentMark Dowd, John McDonald, Justin Schuh.
REF-1479
State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and EvaluationGregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx
登録情報
| 名前 | 組織 | 日付 | リリース日 | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 1.12 |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated References, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Detection_Factors | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships, Type | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Observed_Examples, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Mapping_Notes | |
| CWE Content Team | MITRE | updated Detection_Factors, References | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Time_of_Introduction, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Dimensions |
