Weakness (CWE)
CWE-617: Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
How to prevent it (4 mitigations)
-
Implementation
If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
-
Implementation
Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.
-
Implementation
Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)
-
Implementation
Perform input validation on user data.
Source: MITRE CWE-617
315 results · Clear filters · Feed
-
Medium 6.3
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the…
-
Medium 5.3
Open5GS MME versions <= 2.6.4 contain a buffer overflow in the ASN.1 deserialization function of the S1AP handler. This…
-
Medium 5.3
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the…
-
Medium 5.3
Open5GS MME versions <= 2.6.4 contain an assertion that can be remotely triggered via a malformed ASN.1 packet over the…
-
Medium 5.3
A reachable assertion in the ogs_kdf_hash_mme function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Servic…
-
Medium 5.5
netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level cgroup maximum depth is INT_MAX by default, there is a cgroup toggle to restrict this maximum depth to a more reasonable val…
-
Medium 4.4
In wlan STA driver, there is a possible reachable assertion due to improper exception handling. This could lead to loca…
-
Medium 6.5
Denial of Service in Silicon Labs RS9116 Bluetooth SDK
Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service. If a watchdog timer is not enabled, a hard reset is required to recover …
-
Medium 6.5
Denial of Service in Silicon Labs RS9116 Bluetooth SDK
An assert may be triggered, causing a temporary denial of service when a peer device sends a specially crafted malformed L2CAP packet. If a watchdog timer is not enabled, a hard reset is required to recover the device.
-
Medium 6.5
In Bluetooth firmware, there is a possible firmware asssert due to improper handling of exceptional conditions. This co…
-
Medium 6.8
Cisco IOS XR Software BGP Resource Public Key Infrastructure Denial of Service Vulnerability
A vulnerability in the implementation of the Resource Public Key Infrastructure (RPKI) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Border Gateway Protocol (BGP) process to crash, resulting in a denial of …
-
Medium 6.5
libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_enco…
-
Medium 6.5
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp X…
-
Medium 6.5
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cp…
-
Medium 5.5
Wasmtime runtime crash when combining tail calls with trapping imports
Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compil…
-
Medium 5.5
Qemu-kvm: usb: assertion failure in usb_ep_get()
A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and c…
-
Medium 6.5
Reachable Assertion in Multi Mode Call Processor
Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs to send status message to network.
-
Medium 5.3
MongoDB Server (mongod) may crash when generating ftdc
An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0…
-
Medium 6.2
Jerryscript commit cefd391 was discovered to contain an Assertion Failure via ECMA_STRING_IS_REF_EQUALS_TO_ONE (string_…
-
Medium 5.5
Qemu-kvm: net: assertion failure in update_sctp_checksum()
A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a den…
-
Medium 5.5
In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and cr…
-
Medium 5.3
Libnbd: malicious nbd server may crash libnbd
A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue may allow a malicious NBD server to cause a Denial of Service.
-
Medium 6.2
Reachable assertion in avahi_alternative_host_name
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.
-
Medium 6.2
Reachable assertion in avahi_rdata_parse
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
-
Medium 6.2
Reachable assertion in dbus_set_host_name
A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
-
Medium 6.2
Reachable assertion in avahi_escape_label
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
-
Medium 6.2
Reachable assertion in avahi_dns_packet_append_record
A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
-
Medium 6.5
Junos OS and Junos OS Evolved: Receipt of a specific genuine PIM packet causes RPD crash
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows to send specific genuine PIM packets to the device resulting in rpd to crash causing a Denial of Service (DoS). Continued receipt…
-
Medium 5.3
Incorrect request error handling triggers server crash in Vapor
Vapor is an HTTP web framework for Swift. There is a denial of service vulnerability impacting all users of affected versions of Vapor. The HTTP1 error handler closed connections when HTTP parse errors occur instead of passing them on. The issue is fixed as o…
-
Medium 5.6
Triggerable assertion due to race condition in hot-unplug
A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a de…
-
Medium 5.5
An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows…
-
Medium 5.5
Junos OS and Junos OS Evolved: An rpd crash occurs when a specific L2VPN command is run
A Reachable Assertion vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a locally-based, low-privileged attacker to cause a Denial of Service (DoS). On all Junos OS and Junos OS Evolved, when a specific L2…
-
Medium 5.3
malformed proposed intoto v0.0.2 entries can cause a panic in Rekor
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recov…
-
Medium 5.5
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the jcontext_raise_exception at jer…
-
Medium 5.5
Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the jmem_heap_finalize at jerry-cor…
-
Medium 5.5
Jerryscript 3.0 *commit 1a2c047) was discovered to contain an Assertion Failure via the component parser_parse_class at…
-
Medium 5.5
Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the parser_parse_function_arguments…
-
Medium 5.5
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm_loop at jerry-core/vm/vm.c.
-
Medium 5.5
Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_big_uint_div_mod at jerry-…
-
Medium 5.5
llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation wa…