Weakness (CWE)
CWE-190: Integer Overflow or Wraparound
The product performs a calculation that can
produce an integer overflow or wraparound when the logic
assumes that the resulting value will always be larger than
the original value. This occurs when an integer value is
incremented to a value that is too large to store in the
associated representation. When this occurs, the value may
become a very small or negative number.
How to prevent it (7 mitigations)
-
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
If possible, choose a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
-
Implementation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
-
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Implementation
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
Source: MITRE CWE-190
2,081 results · Feed
-
Critical 9.0
An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry®…
-
High 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
-
High 7.5
Overflow in prost-types
An issue was discovered in the prost-types crate before 0.8.0 for Rust. An overflow can occur during conversion from Timestamp to SystemTime.
-
Critical 9.8
Overflow in libsecp256k1
An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
-
High 7.8CVE-2021-38185 Public exploit
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_…
-
High 7.8
DaviewIndy v8.98.7.0 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malfor…
-
Critical 9.8
An integer overflow vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.9. A…
-
Medium 5.9
Integer Overflow in Chunked Transfer-Encoding
hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream …
-
Medium 6.5
Integer overflow in pywin32
An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could cra…
-
Unscored —
A flaw was found in djvulibre-3.5.28 and earlier. An integer overflow in function render() in tools/ddjvu via crafted d…
-
Unscored —
malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds
Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code i…
-
High 7.8
UnEGG v0.5 and eariler versions have a Integer overflow vulnerability, triggered when the user opens a malformed specif…
-
Critical 9.8
NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modificat…
-
Unscored —
There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger …
-
Unscored —
A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. Whil…
-
Medium 6.9
Integer Overflow in memory allocating functions
Integer Overflow in memory allocating functions. Zephyr versions >= 1.14.2, >= 2.4.0 contain Integer Overflow or Wraparound (CWE-190). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-94vp-8gc2-rm45
-
Unscored —
An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could…
-
Low 2.5
CHECK-fail in AddManySparseToTensorsMap
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.AddManySparseToTensorsMap`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/6…
-
Medium 6.3
Integer overflow in TFLite concatentation
TensorFlow is an end-to-end open source platform for machine learning. The TFLite implementation of concatenation is vulnerable to an integer overflow issue(https://github.com/tensorflow/tensorflow/blob/7b7352a724b690b11bfaae2cd54bc3907daf6285/tensorflow/lite…
-
High 7.1
Integer overflow in TFLite memory allocation
TensorFlow is an end-to-end open source platform for machine learning. The TFLite code for allocating `TFLiteIntArray`s is vulnerable to an integer overflow issue(https://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflo…
-
Low 2.5
CHECK-fail due to integer overflow
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in caused by an integer overflow in constructing a new tensor shape. This is because the implementation(https://github.com/te…
-
Unscored —
In ImageMagick versions before 7.0.9-0, there are outside the range of representable values of type 'float' at MagickCo…
-
Unscored —
A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnai…
-
Unscored —
An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues suc…
-
Unscored —
Multiple integer overflow issues exist while processing long domain names, which may allow an attacker to remotely exec…
-
Unscored —
The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to…
-
Unscored —
The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, whic…
-
High 7.5
Vulnerability in the COPY command for large intsets
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt the heap and potentially result with remote code execution. …
-
High 7.5
Vulnerability in the STRALGO LCS command
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-…
-
Unscored —
Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of s…
-
Unscored —
There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able t…
-
Unscored —
A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to…
-
Unscored —
There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause …
-
Unscored —
There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by …
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-…
-
Unscored —
An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to i…
-
Unscored —
A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions …