CWE-682
DiscouragedIncorrect Calculation
Abstraction: Pillar · Status: Draft
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
180 vulnerabilities reference this CWE, most recent first.
GHSA-HCW3-J74M-QC58
Vulnerability from github – Published: 2022-02-09 22:17 – Updated: 2024-05-20 20:41Impact
Under certain conditions, pretty-printing an AST that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted are those that parse and compare web paths, see the example below.
All of these three conditions have to be met to create an adverse effect:
- An AST of Rego had to be created programmatically such that it ends up containing terms without a location (such as wildcard variables).
- The AST had to be pretty-printed using the
github.com/open-policy-agent/opa/formatpackage. - The result of the pretty-printing had to be parsed and evaluated again via an OPA instance using the bundles, or the Golang packages.
If any of these three conditions are not met, you are not affected.
Notably, all three would be true if using optimized bundles, i.e. bundles created with opa build -O=1 or higher.
In that case, the optimizer would fulfil condition (1.), the result of that would be pretty-printed when writing the bundle to disk, fulfilling (2.). When the bundle was then used, we'd satisfy (3.).
Example
For example, the process outlined above could turn this rule
hello {
["foo", _] = split(input.resource, "/")
}
into
hello {
[_, "foo"] = split(input.resource, "/")
}
with an input of
{
"resource": "foo/bar"
}
the result would change from
{
"hello": true
}
to (no default value of hello)
{}
The severity was determined to be moderate because the conditions are quite particular. Please note that its only the OPA bundle build process thats affected. An OPA sidecar of version 0.36.0 with an optimized bundle built by OPA 0.32.1 would not face this bug.
Patches
Fixed in version 0.37.2.
Workarounds
- Disabling optimization when creating bundles.
References
- Introduced in https://github.com/open-policy-agent/opa/pull/3851
- Backported for the 0.33.1 patch release: https://github.com/open-policy-agent/opa/commit/bfd984ddf93ef2c4963a08d4fdadae0bcf1a3717
- Fixed by https://github.com/open-policy-agent/opa/commit/932e4ffc37a590ace79e9b75ca4340288c220239 and https://github.com/open-policy-agent/opa/commit/2bd8edab9e10e2dc9cf76ae8335ced0c224f3055
For more information
If you have any questions or comments about this advisory:
- Open an issue in Community Discussions
- Ask in Slack: https://slack.openpolicyagent.org/
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/open-policy-agent/opa"
},
"ranges": [
{
"events": [
{
"introduced": "0.33.1"
},
{
"fixed": "0.37.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-23628"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": true,
"github_reviewed_at": "2022-02-09T22:17:37Z",
"nvd_published_at": "2022-02-09T22:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nUnder certain conditions, pretty-printing an AST that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted are those that parse and compare web paths, see the example below.\n\n**All of these** three conditions have to be met to create an adverse effect:\n\n1. An AST of Rego had to be **created programmatically** such that it ends up containing terms without a location (such as wildcard variables).\n2. The AST had to be **pretty-printed** using the `github.com/open-policy-agent/opa/format` package.\n3. The result of the pretty-printing had to be **parsed and evaluated again** via an OPA instance using the bundles, or the Golang packages.\n\nIf any of these three conditions are not met, you are not affected.\n\nNotably, all three would be true if using **optimized bundles**, i.e. bundles created with `opa build -O=1` or higher.\nIn that case, the optimizer would fulfil condition (1.), the result of that would be pretty-printed when writing the bundle to disk, fulfilling (2.). When the bundle was then used, we\u0027d satisfy (3.).\n\n#### Example\nFor example, the process outlined above could turn \nthis rule\n```rego\nhello {\n\t[\"foo\", _] = split(input.resource, \"/\")\n}\n```\n\ninto\n```rego\nhello {\n\t[_, \"foo\"] = split(input.resource, \"/\")\n}\n```\n\nwith an input of\n```rego\n{\n \"resource\": \"foo/bar\"\n}\n```\n\nthe result would change from\n```rego\n{\n \"hello\": true\n}\n```\nto (no default value of hello)\n```rego\n{}\n```\n\nThe severity was determined to be *moderate* because the conditions are quite particular. Please note that its only the OPA bundle build process thats affected. An OPA sidecar of version 0.36.0 with an optimized bundle built by OPA 0.32.1 would not face this bug.\n\n### Patches\n\nFixed in version 0.37.2.\n\n### Workarounds\n\n- Disabling optimization when creating bundles.\n\n### References\n\n- Introduced in https://github.com/open-policy-agent/opa/pull/3851\n- Backported for the 0.33.1 patch release: https://github.com/open-policy-agent/opa/commit/bfd984ddf93ef2c4963a08d4fdadae0bcf1a3717\n- Fixed by https://github.com/open-policy-agent/opa/commit/932e4ffc37a590ace79e9b75ca4340288c220239 and https://github.com/open-policy-agent/opa/commit/2bd8edab9e10e2dc9cf76ae8335ced0c224f3055\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [Community Discussions](https://github.com/open-policy-agent/community/discussions/categories/opa-and-rego)\n* Ask in Slack: https://slack.openpolicyagent.org/",
"id": "GHSA-hcw3-j74m-qc58",
"modified": "2024-05-20T20:41:41Z",
"published": "2022-02-09T22:17:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-policy-agent/opa/security/advisories/GHSA-hcw3-j74m-qc58"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23628"
},
{
"type": "WEB",
"url": "https://github.com/open-policy-agent/opa/pull/3851"
},
{
"type": "WEB",
"url": "https://github.com/open-policy-agent/opa/commit/2bd8edab9e10e2dc9cf76ae8335ced0c224f3055"
},
{
"type": "WEB",
"url": "https://github.com/open-policy-agent/opa/commit/932e4ffc37a590ace79e9b75ca4340288c220239"
},
{
"type": "WEB",
"url": "https://github.com/open-policy-agent/opa/commit/bfd984ddf93ef2c4963a08d4fdadae0bcf1a3717"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-policy-agent/opa"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0316"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Incorrect Calculation in github.com/open-policy-agent/opa"
}
GHSA-HH7C-JPM3-846Q
Vulnerability from github – Published: 2022-04-16 00:00 – Updated: 2022-04-23 00:03STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac.
{
"affected": [],
"aliases": [
"CVE-2022-28048"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-15T14:15:00Z",
"severity": "HIGH"
},
"details": "STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac.",
"id": "GHSA-hh7c-jpm3-846q",
"modified": "2022-04-23T00:03:21Z",
"published": "2022-04-16T00:00:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28048"
},
{
"type": "WEB",
"url": "https://github.com/nothings/stb/issues/1293"
},
{
"type": "WEB",
"url": "https://github.com/nothings/stb/pull/1297"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXLM5XL77SNH4IPTSXOQD7XL4E2EMIN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I4HXIWU5HBOADXZVMREHT4YTO5WVYXEQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MMBCMJGAZRQS55SNECUWZSC5URVLEZ5R"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HHWH-Q2MG-R3CP
Vulnerability from github – Published: 2022-04-16 00:00 – Updated: 2022-04-23 00:03An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.c to result in an extremely large value in order to cause a segmentation fault and crash the application. This is a digs-- calculation.
{
"affected": [],
"aliases": [
"CVE-2021-44491"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-15T18:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.c to result in an extremely large value in order to cause a segmentation fault and crash the application. This is a digs-- calculation.",
"id": "GHSA-hhwh-q2mg-r3cp",
"modified": "2022-04-23T00:03:15Z",
"published": "2022-04-16T00:00:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44491"
},
{
"type": "WEB",
"url": "https://gitlab.com/YottaDB/DB/YDB/-/issues/828"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HJWV-27QH-X9J5
Vulnerability from github – Published: 2022-01-26 00:00 – Updated: 2022-02-02 00:02On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffic due to an issue in the SYN Cookie Protection feature. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
{
"affected": [],
"aliases": [
"CVE-2022-23011"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-25T20:15:00Z",
"severity": "HIGH"
},
"details": "On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffic due to an issue in the SYN Cookie Protection feature. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"id": "GHSA-hjwv-27qh-x9j5",
"modified": "2022-02-02T00:02:02Z",
"published": "2022-01-26T00:00:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23011"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K68755210"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-HMVX-MW63-JVG7
Vulnerability from github – Published: 2024-07-30 09:32 – Updated: 2024-07-30 21:31In the Linux kernel, the following vulnerability has been resolved:
btrfs: zoned: fix calc_available_free_space() for zoned mode
calc_available_free_space() returns the total size of metadata (or system) block groups, which can be allocated from unallocated disk space. The logic is wrong on zoned mode in two places.
First, the calculation of data_chunk_size is wrong. We always allocate one zone as one chunk, and no partial allocation of a zone. So, we should use zone_size (= data_sinfo->chunk_size) as it is.
Second, the result "avail" may not be zone aligned. Since we always allocate one zone as one chunk on zoned mode, returning non-zone size aligned bytes will result in less pressure on the async metadata reclaim process.
This is serious for the nearly full state with a large zone size device. Allowing over-commit too much will result in less async reclaim work and end up in ENOSPC. We can align down to the zone size to avoid that.
{
"affected": [],
"aliases": [
"CVE-2024-42231"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T08:15:08Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: zoned: fix calc_available_free_space() for zoned mode\n\ncalc_available_free_space() returns the total size of metadata (or\nsystem) block groups, which can be allocated from unallocated disk\nspace. The logic is wrong on zoned mode in two places.\n\nFirst, the calculation of data_chunk_size is wrong. We always allocate\none zone as one chunk, and no partial allocation of a zone. So, we\nshould use zone_size (= data_sinfo-\u003echunk_size) as it is.\n\nSecond, the result \"avail\" may not be zone aligned. Since we always\nallocate one zone as one chunk on zoned mode, returning non-zone size\naligned bytes will result in less pressure on the async metadata reclaim\nprocess.\n\nThis is serious for the nearly full state with a large zone size device.\nAllowing over-commit too much will result in less async reclaim work and\nend up in ENOSPC. We can align down to the zone size to avoid that.",
"id": "GHSA-hmvx-mw63-jvg7",
"modified": "2024-07-30T21:31:27Z",
"published": "2024-07-30T09:32:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42231"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/64d2c847ba380e07b9072d65a50aa6469d2aa43f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8548903b1999bba02a2b894ad750ab8eb1f40307"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HPW2-J46J-HPV2
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory.
{
"affected": [],
"aliases": [
"CVE-2017-2618"
],
"database_specific": {
"cwe_ids": [
"CWE-193",
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-27T19:29:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the Linux kernel\u0027s handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory.",
"id": "GHSA-hpw2-j46j-hpv2",
"modified": "2022-05-13T01:36:53Z",
"published": "2022-05-13T01:36:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2618"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0931"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0932"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0933"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2017-2618"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1419916"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2618"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0c461cb727d146c9ef2d3e86214f498b78b7d125"
},
{
"type": "WEB",
"url": "https://marc.info/?l=selinux\u0026m=148588165923772\u0026w=2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-3791"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96272"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HX96-88F5-C8JV
Vulnerability from github – Published: 2023-06-12 21:30 – Updated: 2024-04-04 04:44A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.
{
"affected": [],
"aliases": [
"CVE-2023-3161"
],
"database_specific": {
"cwe_ids": [
"CWE-1335",
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-12T20:15:12Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font-\u003ewidth and font-\u003eheight greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.",
"id": "GHSA-hx96-88f5-c8jv",
"modified": "2024-04-04T04:44:25Z",
"published": "2023-06-12T21:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3161"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/2b09d5d364986f724f17001ccfe4126b9b43a0be"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213485"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J64F-PWH4-GJQV
Vulnerability from github – Published: 2022-01-26 00:00 – Updated: 2022-02-02 00:02On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookie protection (TCP Half Open flood vector) is activated in the AFM Device Dos or DOS profile, certain types of TCP connections will fail. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
{
"affected": [],
"aliases": [
"CVE-2022-23028"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-25T20:15:00Z",
"severity": "MODERATE"
},
"details": "On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookie protection (TCP Half Open flood vector) is activated in the AFM Device Dos or DOS profile, certain types of TCP connections will fail. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"id": "GHSA-j64f-pwh4-gjqv",
"modified": "2022-02-02T00:02:00Z",
"published": "2022-01-26T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23028"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K16101409"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JMG2-F5XG-MF62
Vulnerability from github – Published: 2026-08-05 18:31 – Updated: 2026-08-14 21:31As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20270 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-682.
{
"affected": [],
"aliases": [
"CVE-2026-20270"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-05T17:16:48Z",
"severity": "HIGH"
},
"details": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\n\nThe vulnerabilities tracked by CVE-2026-20270 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-682.",
"id": "GHSA-jmg2-f5xg-mf62",
"modified": "2026-08-14T21:31:11Z",
"published": "2026-08-05T18:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20270"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ"
},
{
"type": "WEB",
"url": "https://www.cve.org/Media/News/item/blog/2026/06/16/Preserving-Vulnerability-Level-Identification"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JP29-XJV5-G87X
Vulnerability from github – Published: 2026-09-02 18:32 – Updated: 2026-09-02 18:32As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20275 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-682.
{
"affected": [],
"aliases": [
"CVE-2026-20275"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-02T17:17:32Z",
"severity": "HIGH"
},
"details": "As part of Cisco\u0027s ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.\n\nThe vulnerabilities tracked by CVE-2026-20275 are related to incorrect calculation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-682.",
"id": "GHSA-jp29-xjv5-g87x",
"modified": "2026-09-02T18:32:26Z",
"published": "2026-09-02T18:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20275"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxr-qg64NcM"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Understand your programming language's underlying representation and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how your language handles numbers that are too large or too small for its underlying representation.
Mitigation MIT-8
Strategy: Input Validation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Mitigation
Use the appropriate type for the desired action. For example, in C/C++, only use unsigned types for values that could never be negative, such as height, width, or other numbers related to quantity.
Mitigation
Strategy: Language Selection
- Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).
Mitigation
Strategy: Libraries or Frameworks
- Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).
Mitigation MIT-26
Strategy: Compilation or Build Hardening
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
CAPEC-128: Integer Attacks
An attacker takes advantage of the structure of integer variables to cause these variables to assume values that are not expected by an application. For example, adding one to the largest positive integer in a signed integer variable results in a negative number. Negative numbers may be illegal in an application and the application may prevent an attacker from providing them directly, but the application may not consider that adding two positive numbers can create a negative number do to the structure of integer storage formats.
CAPEC-129: Pointer Manipulation
This attack pattern involves an adversary manipulating a pointer within a target application resulting in the application accessing an unintended memory location. This can result in the crashing of the application or, for certain pointer values, access to data that would not normally be possible or the execution of arbitrary code. Since pointers are simply integer variables, Integer Attacks may often be used in Pointer Attacks.