名稱: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
一般資訊
引入方式
Implementation : The uncontrolled recursion is often due to an improper or missing conditional適用平台
程式語言
類別： Not Language-Specific (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Availability | DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory) 注意：Resources including CPU, memory, and stack memory could be rapidly consumed or exhausted, eventually leading to an exit or crash. | |
| Confidentiality | Read Application Data 注意：In some cases, an application's interpreter might kill a process or thread that appears to be consuming too many resources, such as with PHP's memory_limit setting. When the interpreter kills the process/thread, it might report an error containing detailed information such as the application's installation path. |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2007-1285 | Deeply nested arrays trigger stack exhaustion. |
CVE-2007-3409 | Self-referencing pointers create infinite loop and resultant stack exhaustion. |
CVE-2016-10707 | Javascript application accidentally changes input in a way that prevents a recursive call from detecting an exit condition. |
CVE-2016-3627 | An attempt to recover a corrupted XML file infinite recursion protection counter was not always incremented missing the exit condition. |
CVE-2019-15118 | USB-audio driver's descriptor code parsing allows unlimited recursion leading to stack exhaustion. |
潛在緩解措施
Phases : ImplementationEnsure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Phases : Implementation
Increase the stack size.
偵測方法
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)有效性 : High
漏洞對應備注
理由說明 : This CWE entry is a Class and might have Base-level children that would be more appropriate備註 : Examine children of this entry to see if there is a better fit
相關攻擊模式
| CAPEC ID | 攻擊模式名稱 |
|---|---|
| CAPEC-230 | Serialized Data with Nested Payloads
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization. |
| CAPEC-231 | Oversized Serialized Data Payloads
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution. |
參考資料
REF-961
Automated Source Code Reliability Measure (ASCRM)Object Management Group (OMG).
http://www.omg.org/spec/ASCRM/1.0/
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | Draft 9 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Potential_Mitigations, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Relationships | |
| CWE Content Team | MITRE | updated References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns, Relationships, Type | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns, Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Description, Modes_of_Introduction, Observed_Examples, Potential_Mitigations, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Description, Relationships | |
| CWE Content Team | MITRE | updated Detection_Factors, Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Common_Consequences |
