CWE-834
Excessive Iteration
2011-03-30
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Thông tin chung
Các cách xuất hiện
ImplementationNền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Công nghệ
Lớp: Not Technology-Specific (Undetermined)Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Availability | DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Amplification, DoS: Crash, Exit, or Restart Ghi chú: Excessive looping will cause unexpected consumption of resources, such as CPU cycles or memory. The product's operation may slow down, or cause a long time to respond. If limited resources such as memory are consumed for each iteration, the loop may eventually cause a crash or program exit due to exhaustion of resources, such as an out-of-memory error. In many cases, a loop does not need to be infinite in order to cause enough resource consumption to adversely affect the product or its host system; it depends on the amount of resources consumed per iteration. |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-2011-1027 | Chain: off-by-one error (CWE-193) leads to infinite loop (CWE-835) using invalid hex-encoded characters. |
CVE-2006-6499 | Chain: web browser crashes due to infinite loop - "bad looping logic [that relies on] floating point math [CWE-1339] to exit the loop [CWE-835]" |
Phương pháp phát hiện
Dynamic Analysis with Manual Results Interpretation
Hiệu quả : SOAR PartialManual Static Analysis - Source Code
Hiệu quả : SOAR PartialAutomated Static Analysis - Source Code
Hiệu quả : HighArchitecture or Design Review
Hiệu quả : HighGhi chú ánh xạ lỗ hổng
Lý do : This CWE entry is a level-1 Class (i.e., a child of a Pillar). It might have lower-level children that would be more appropriateBình luận : Examine children of this entry to see if there is a better fit
Tài liệu tham khảo
REF-62
The Art of Software Security AssessmentMark Dowd, John McDonald, Justin Schuh.
REF-1479
State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and EvaluationGregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 1.12 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated References, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Detection_Factors | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships, Type | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Observed_Examples, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Mapping_Notes | |
| CWE Content Team | MITRE | updated Detection_Factors, References | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Time_of_Introduction, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Dimensions |
