Weakness (CWE)
CWE-188: Reliance on Data/Memory Layout
The product makes invalid assumptions about how protocol data or memory is organized at a lower level.
How to prevent it (3 mitigations)
-
Implementation, Architecture and Design
In flat address space situations, never allow computing memory addresses as offsets from another memory address.
-
Architecture and Design
Fully specify protocol layout unambiguously, providing a structured grammar (e.g., a compilable yacc grammar).
-
Testing
Testing: Test that the implementation properly handles each case in the protocol grammar.
Source: MITRE CWE-188
6 results · Clear filters · Feed
-
Medium 6.8
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An…
-
Medium —
Diesel: Possible unaligned data access for implementations of `SqliteAggregate`
Diesel allows to register custom aggregate SQL functions for SQLite via the `SqliteAggregate` interface. To store an instance of the custom aggregate processor Diesel relied on the `sqlite3_aggregate_context` function provided by sqlite. This function doesn't…
-
Medium 6.6
iccDEV has Type Confusion during XML Curve Serialization
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Type Confusion in its CIccSingleSampledeCurveXml class during XML Curve Serialization. This issue is fixed in version 2.3…
-
Medium 5.5
socket2 invalidly assumes the memory layout of std::net::SocketAddr
An issue was discovered in the net2 crate before 0.2.36 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
-
Medium 5.5
miow invalidly assumes the memory layout of std::net::SocketAddr
An issue was discovered in the miow crate before 0.3.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
-
Medium 5.5
mio invalidly assumes the memory layout of std::net::SocketAddr
An issue was discovered in the mio crate before 0.7.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.