Skip to content
OpenAdvisories

Weakness (CWE)

CWE-682: Incorrect Calculation

Pillar Draft Mapping discouraged

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

How to prevent it (6 mitigations)

  1. Implementation

    Understand your programming language's underlying representation and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how your language handles numbers that are too large or too small for its underlying representation.

  2. Implementation

    Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.

  3. Implementation

    Use the appropriate type for the desired action. For example, in C/C++, only use unsigned types for values that could never be negative, such as height, width, or other numbers related to quantity.

  4. Architecture and Design

    Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences.

    Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).

  5. Architecture and Design

    Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences.

    Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).

  6. Implementation

    Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.

Source: MITRE CWE-682

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 10.0
    CVE-2023-2163 Public exploit

    Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation

    Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2022-30600 Public exploit

    Incorrect Calculation in moodle

    A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.1
    CVE-2022-23636 Public exploit

    Invalid drop of partially-initialized instances in wasmtime

    Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator in Wasmtime's runtime where a failure to instantiate an instance for a module that defines an `externref` glob…

    bytecodealliance wasmtime wasmtime cranelift-codegen crates.io
  • High 8.8
    CVE-2021-45960 Public exploit

    In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…

    firefox insighttoolkit4 expat swish-e Debian Ubuntu Alpine
  • High 8.8
    CVE-2021-31440 Public exploit

    This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An …

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2020-0022 Public exploit

    In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds ca…

    Android