CWE-196 无符号至有符号转换错误

Unsigned to Signed Conversion Error

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: Medium

基本描述

The software uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.

扩展描述

Although less frequent an issue than signed-to-unsigned conversion, unsigned-to-signed conversion can be the perfect precursor to dangerous buffer underwrite conditions that allow attackers to move down the stack where they otherwise might not have access in a normal buffer overflow condition. Buffer underwrites occur frequently when large unsigned values are cast to signed values, and then used as indexes into a buffer or for pointer arithmetic.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 681 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 681 cwe_View_ID: 699 cwe_Ordinal: Primary

• cwe_Nature: CanAlsoBe cwe_CWE_ID: 124 cwe_View_ID: 1000

• cwe_Nature: CanAlsoBe cwe_CWE_ID: 120 cwe_View_ID: 1000

适用平台

Language: [{'cwe_Name': 'C', 'cwe_Prevalence': 'Undetermined'}, {'cwe_Name': 'C++', 'cwe_Prevalence': 'Undetermined'}]

常见的影响

范围	影响	注释
Availability	DoS: Crash, Exit, or Restart	Incorrect sign conversions generally lead to undefined behavior, and therefore crashes.
Integrity	Modify Memory	If a poor cast lead to a buffer overflow or similar condition, data integrity may be affected.
['Integrity', 'Confidentiality', 'Availability', 'Access Control']	['Execute Unauthorized Code or Commands', 'Bypass Protection Mechanism']	Improper signed-to-unsigned conversions without proper checking can sometimes trigger buffer overflows which can be used to execute arbitrary code. This is usually outside the scope of a program's implicit security policy.

可能的缓解方案

Requirements

策略:

Choose a language which is not subject to these casting flaws.

Architecture and Design

策略:

Design object accessor functions to implicitly check values for valid sizes. Ensure that all functions which will be used as a size are checked previous to use as a size. If the language permits, throw exceptions rather than using in-band errors.

Implementation

策略:

Error check the return values of all functions. Be aware of implicit casts made, and use unsigned variables for sizes if at all possible.

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
CLASP			Unsigned to signed conversion error
Software Fault Patterns	SFP1		Glitch in computation

相关攻击模式

• CAPEC-92

引用

• REF-62 The Art of Software Security Assessment

文章来源于互联网:scap中文网