CWE-1038 詳細資料

CWE-1038

Insecure Automated Optimizations
2018-03-29
00h00 +00:00
低危
Draft
2026-10-28
00h00 +00:00
指定 CWE 通知
掌握特定 CWE 的任何變更。
管理通知

名稱: Insecure Automated Optimizations

The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.

一般資訊

引入方式

Architecture and Design : Optimizations built into the design of a product can have unintended consequences during execution.

適用平台

程式語言

類別: Not Language-Specific (Undetermined)

常見後果

範圍 影響 可能性
IntegrityAlter Execution Logic

注意:The optimizations alter the order of execution resulting in side effects that were not intended by the original developer.

觀察到的案例

參考資料 描述

CVE-2017-5715

Intel, ARM, and AMD processor optimizations related to speculative execution and branch prediction cause access control checks to be bypassed when placing data into the cache. Often known as "Spectre".

CVE-2008-1685

C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.

漏洞對應備注

理由說明 : This CWE entry is a Class and might have Base-level children that would be more appropriate
備註 : Examine children of this entry to see if there is a better fit

提交

名稱 機構 日期 發布日期 Version
CWE Content Team MITRE 2018-03-07 +00:00 2018-03-29 +00:00 3.1

修改記錄

名稱 機構 日期 備註
CWE Content Team MITRE 2020-02-24 +00:00 updated Relationships
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2023-10-26 +00:00 updated Observed_Examples
CWE Content Team MITRE 2025-12-11 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2026-10-28 +00:00 updated Dimensions