Weakness (CWE)
CWE-190: Integer Overflow or Wraparound
The product performs a calculation that can
produce an integer overflow or wraparound when the logic
assumes that the resulting value will always be larger than
the original value. This occurs when an integer value is
incremented to a value that is too large to store in the
associated representation. When this occurs, the value may
become a very small or negative number.
How to prevent it (7 mitigations)
-
Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
If possible, choose a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
-
Implementation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
-
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Implementation
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
Source: MITRE CWE-190
2,081 results · Feed
-
Medium 5.7
There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a s…
-
Medium 5.7
There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at ma…
-
Medium 5.9
Insecure Encryption
Data is truncated wrong when its length is greater than 255 bytes.
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Wr…
-
Medium 6.8
Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow
A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
-
Critical 9.0
MQTT buffer overflow on receive buffer
In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
-
High 7.7
Signature Malleabillity in elliptic
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
-
High 8.0
Integer Overflow in FreeRDP
In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0.
-
Medium 6.0
A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-u…
-
Medium 5.3
Temporary files are not cleaned after OOM when parsing HTTP request data
In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop p…
-
Medium 5.1
A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_l…
-
Medium 5.1
A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on t…
-
Medium 5.1
A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for us…
-
High 8.8CVE-2020-6092 EPSS 43%
An exploitable code execution vulnerability exists in the way Nitro Pro 13.9.1.155 parses Pattern objects. A specially …
-
High 7.5
Integer Overflow In is_in_region Allows User Thread To Access Kernel Memory
A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers. The impact would depend on the underlying system call and can range from denial of service to information leak to memory corruption re…
-
Critical 9.8
An exploitable code execution vulnerability exists in the TIFF fillinraster function of the igcore19d.dll library of Ac…
-
High 7.5
Junos OS: High-End SRX Series: Multicast traffic might cause all FPCs to reset.
On High-End SRX Series devices, in specific configurations and when specific networking events or operator actions occur, an SPC receiving genuine multicast traffic may core. Subsequently, all FPCs in a chassis may reset causing a Denial of Service. This issu…
-
High 7.5
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-…
-
High 7.8CVE-2020-8844 EPSS 24%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25…
-
Medium 6.3
Integer overflow in bson_ensure_space
Kevin Backhouse discovered an integer overflow in bson_ensure_space, as used in whoopsie.
-
High 7.4
Cisco FXOS, IOS XR, and NX-OS Software Cisco Discovery Protocol Denial of Service Vulnerability
A vulnerability in the Cisco Discovery Protocol implementation for Cisco FXOS Software, Cisco IOS XR Software, and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service…
-
High 7.5
Uncontrolled Resource Consumption in Pillow
There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due …
-
High 8.8
Integer overflow in Pillow
libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
-
Unscored —
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network acce…
-
Unscored —
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network acce…
-
Unscored —
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network acce…
-
Unscored —
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network acce…
-
Unscored —
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network acce…
-
Unscored —
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network acce…
-
Unscored —
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network acce…
-
Unscored —
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network acce…
-
Critical 9.8
An exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, …
-
High 8.1
An exploitable code execution vulnerability exists in the DICOM network response functionality of LEADTOOLS libltdic.so…
-
High 8.8
An exploitable integer overflow vulnerability exists in the BMP header parsing functionality of LEADTOOLS 20. A special…
-
High 8.8
An exploitable memory corruption vulnerability exists in Investintech Able2Extract Professional 4.0.7 x64. A specially …
-
Unscored —
The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger …
-
Unscored —
An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on t…
-
Medium 6.5
Integer overflow in whoopsie results in out-of-bounds heap write
An integer overflow in whoopsie before versions 0.2.52.5ubuntu0.1, 0.2.62ubuntu0.1, 0.2.64ubuntu0.1, 0.2.66, results in an out-of-bounds write to a heap allocated buffer when processing large crash dumps. This results in a crash or possible code-execution in …
-
High 8.2
An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version …
-
High 7.5
An exploitable denial-of-service vulnerability exists in the Weave certificate loading functionality of Nest Cam IQ Ind…