CWE-682
DiscouragedIncorrect Calculation
Abstraction: Pillar · Status: Draft
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
173 vulnerabilities reference this CWE, most recent first.
GHSA-V592-XF75-856P
Vulnerability from github – Published: 2021-06-29 21:12 – Updated: 2025-01-30 14:39Impact
An ethash mining DAG generation flaw in Geth could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected.
Patches
This issue is also fixed as of 1.9.24. Thanks to @slavikus for bringing the issue to our attention and writing the fix.
Workarounds
This PR implements a patch: https://github.com/ethereum/go-ethereum/pull/21793
References
https://blog.ethereum.org/2020/11/12/geth_security_release/
For more information
If you have any questions or comments about this advisory: * Open an issue in go-ethereum * Email us at security@ethereum.org
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/ethereum/go-ethereum"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-26240"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-21T21:52:58Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nAn ethash mining DAG generation flaw in Geth could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected.\n\n### Patches\nThis issue is also fixed as of 1.9.24. Thanks to @slavikus for bringing the issue to our attention and writing the fix. \n\n### Workarounds\nThis PR implements a patch: https://github.com/ethereum/go-ethereum/pull/21793 \n\n### References\nhttps://blog.ethereum.org/2020/11/12/geth_security_release/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)\n* Email us at [security@ethereum.org](mailto:security@ethereum.org)",
"id": "GHSA-v592-xf75-856p",
"modified": "2025-01-30T14:39:18Z",
"published": "2021-06-29T21:12:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ethereum/go-ethereum/security/advisories/GHSA-v592-xf75-856p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26240"
},
{
"type": "WEB",
"url": "https://github.com/ethereum/go-ethereum/pull/21793"
},
{
"type": "WEB",
"url": "https://github.com/ethereum/go-ethereum/commit/d990df909d7839640143344e79356754384dcdd0"
},
{
"type": "WEB",
"url": "https://blog.ethereum.org/2020/11/12/geth_security_release"
},
{
"type": "PACKAGE",
"url": "https://github.com/ethereum/go-ethereum"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Erroneous Proof of Work calculation in geth"
}
GHSA-VR7G-PRHX-JMVM
Vulnerability from github – Published: 2022-05-13 01:40 – Updated: 2022-05-13 01:40A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36996978.
{
"affected": [],
"aliases": [
"CVE-2017-0679"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-06T20:29:00Z",
"severity": "HIGH"
},
"details": "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36996978.",
"id": "GHSA-vr7g-prhx-jmvm",
"modified": "2022-05-13T01:40:27Z",
"published": "2022-05-13T01:40:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0679"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2017-07-01"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99478"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VW53-RMXX-2XMR
Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-05-24 17:37The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should.
{
"affected": [],
"aliases": [
"CVE-2021-3004"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-03T04:15:00Z",
"severity": "HIGH"
},
"details": "The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should.",
"id": "GHSA-vw53-rmxx-2xmr",
"modified": "2022-05-24T17:37:52Z",
"published": "2022-05-24T17:37:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3004"
},
{
"type": "WEB",
"url": "https://blocksecteam.medium.com/deposit-less-get-more-ycredit-attack-details-f589f71674c3"
},
{
"type": "WEB",
"url": "https://etherscan.io/address/0xe0839f9b9688a77924208ad509e29952dc660261"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VWW6-323C-PXR2
Vulnerability from github – Published: 2024-03-14 18:30 – Updated: 2024-05-04 18:30Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local access.
{
"affected": [],
"aliases": [
"CVE-2023-43490"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-14T17:15:51Z",
"severity": "MODERATE"
},
"details": "Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local access.",
"id": "GHSA-vww6-323c-pxr2",
"modified": "2024-05-04T18:30:48Z",
"published": "2024-03-14T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43490"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00003.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240405-0009"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W37F-PVVX-WCWM
Vulnerability from github – Published: 2022-05-19 00:00 – Updated: 2022-06-02 14:50A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "3.9"
},
{
"fixed": "3.9.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "3.10"
},
{
"fixed": "3.10.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "3.11"
},
{
"fixed": "3.11.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-30600"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-02T14:50:29Z",
"nvd_published_at": "2022-05-18T18:15:00Z",
"severity": "CRITICAL"
},
"details": "A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.",
"id": "GHSA-w37f-pvvx-wcwm",
"modified": "2022-06-02T14:50:29Z",
"published": "2022-05-19T00:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30600"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/59b5858da200f63ecb59a9113af2b99ef1496fe5"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2083613"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QCTWSE3JDMSYL7DPCMXMMJEXZSS6VIA5"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=434582"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-73736"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Incorrect Calculation in moodle"
}
GHSA-WGR6-65QQ-MVC3
Vulnerability from github – Published: 2023-06-19 03:30 – Updated: 2024-04-04 04:55VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure member.
{
"affected": [],
"aliases": [
"CVE-2023-35848"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-19T03:15:09Z",
"severity": "HIGH"
},
"details": "VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 lacks certain size calculations before attempting to set a value of an mss structure member.",
"id": "GHSA-wgr6-65qq-mvc3",
"modified": "2024-04-04T04:55:52Z",
"published": "2023-06-19T03:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35848"
},
{
"type": "WEB",
"url": "https://github.com/virtualsquare/picotcp/pull/15/files"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WGVC-HF5H-M5H7
Vulnerability from github – Published: 2026-08-11 18:30 – Updated: 2026-08-18 18:31Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
{
"affected": [],
"aliases": [
"CVE-2026-20763"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T17:17:51Z",
"severity": "MODERATE"
},
"details": "Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.",
"id": "GHSA-wgvc-hf5h-m5h7",
"modified": "2026-08-18T18:31:47Z",
"published": "2026-08-11T18:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20763"
},
{
"type": "WEB",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01462.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WJXM-V88J-7GJ4
Vulnerability from github – Published: 2024-06-06 18:30 – Updated: 2024-09-18 15:30An issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9.1 causes an incorrect calculation when the same dimension operation is performed.
{
"affected": [],
"aliases": [
"CVE-2024-36736"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T18:15:16Z",
"severity": "CRITICAL"
},
"details": "An issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9.1 causes an incorrect calculation when the same dimension operation is performed.",
"id": "GHSA-wjxm-v88j-7gj4",
"modified": "2024-09-18T15:30:47Z",
"published": "2024-06-06T18:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36736"
},
{
"type": "WEB",
"url": "https://gist.github.com/Redmept1on/6de04fb6c7af6956973fe2765c4d4576"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WP2G-63G2-RVFW
Vulnerability from github – Published: 2026-08-18 21:34 – Updated: 2026-08-19 12:32Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-76043"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T21:18:28Z",
"severity": "HIGH"
},
"details": "Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-wp2g-63g2-rvfw",
"modified": "2026-08-19T12:32:22Z",
"published": "2026-08-18T21:34:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76043"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/539350801"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X5M4-43JF-HH65
Vulnerability from github – Published: 2026-01-28 16:18 – Updated: 2026-01-28 16:18Impact
Incorrect rounding direction for signed mul and div operations
The mulDiv(x, y, z) function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$.
This resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are fixed_div_floor and fixed_div_ceil, as they often use non-constant numbers as the divisor $z$ in mulDiv.
This error is present in all signed FixedPoint and SorobanFixedPoint implementations, including i64, i128, and I256.
Negative Overflow in i64
The mulDiv(x, y, z) function for i64 used the i128 type to handle "phantom overflows". These are overflows that occur intermediately during a calculation, like when computing the intermediate product $x * y$. When the final result of mulDiv was computed in i128, it was scaled back down to i64 before returning. While the code verified that the result did not exceed i64::MAX, it did not check against i64::MIN.
This caused negative results smaller than i64:MIN to wrap around to a large positive number instead of being caught as an overflow.
This error only exists for the FixedPoint implementation of i64.
Patches
- v1.3.0 users should upgrade to patch v1.3.1
- v1.4.0 users should upgrade to patch v1.4.1
All versions >=v1.4.1 contain the patch.
Workarounds
There are no known workarounds. Upgrade to the patched version.
Credits
soroban-fixed-point-math would like to thank the team at Certora for discovering and reporting the issue.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "soroban-fixed-point-math"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.0"
},
{
"fixed": "1.4.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.4.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "soroban-fixed-point-math"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.3.0"
]
}
],
"aliases": [
"CVE-2026-24783"
],
"database_specific": {
"cwe_ids": [
"CWE-682"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-28T16:18:54Z",
"nvd_published_at": "2026-01-27T22:15:57Z",
"severity": "HIGH"
},
"details": "### Impact\n\n#### Incorrect rounding direction for signed mul and div operations\n\nThe `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$.\n\nThis resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`. \n\nThis error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`.\n\n#### Negative Overflow in `i64`\n\nThe `mulDiv(x, y, z)` function for `i64` used the `i128` type to handle \"phantom overflows\". These are overflows that occur intermediately during a calculation, like when computing the intermediate product $x * y$. When the final result of `mulDiv` was computed in `i128`, it was scaled back down to `i64` before returning. While the code verified that the result did not exceed `i64::MAX`, it did not check against `i64::MIN`.\n\nThis caused negative results smaller than `i64:MIN` to wrap around to a large positive number instead of being caught as an overflow.\n\nThis error only exists for the `FixedPoint` implementation of `i64`. \n\n### Patches\n\n* v1.3.0 users should upgrade to patch v1.3.1\n* v1.4.0 users should upgrade to patch v1.4.1\n\nAll versions `\u003e=v1.4.1` contain the patch. \n\n### Workarounds\nThere are no known workarounds. Upgrade to the patched version.\n\n### Credits\n\nsoroban-fixed-point-math would like to thank the team at [Certora](https://www.certora.com/) for discovering and reporting the issue.",
"id": "GHSA-x5m4-43jf-hh65",
"modified": "2026-01-28T16:18:54Z",
"published": "2026-01-28T16:18:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/script3/soroban-fixed-point-math/security/advisories/GHSA-x5m4-43jf-hh65"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24783"
},
{
"type": "WEB",
"url": "https://github.com/script3/soroban-fixed-point-math/commit/c9233f7094198a49ed66a4d75786a8a3755c936a"
},
{
"type": "PACKAGE",
"url": "https://github.com/script3/soroban-fixed-point-math"
},
{
"type": "WEB",
"url": "https://github.com/script3/soroban-fixed-point-math/releases/tag/v1.3.1"
},
{
"type": "WEB",
"url": "https://github.com/script3/soroban-fixed-point-math/releases/tag/v1.4.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives"
}
Mitigation
Understand your programming language's underlying representation and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how your language handles numbers that are too large or too small for its underlying representation.
Mitigation MIT-8
Strategy: Input Validation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Mitigation
Use the appropriate type for the desired action. For example, in C/C++, only use unsigned types for values that could never be negative, such as height, width, or other numbers related to quantity.
Mitigation
Strategy: Language Selection
- Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).
Mitigation
Strategy: Libraries or Frameworks
- Use languages, libraries, or frameworks that make it easier to handle numbers without unexpected consequences.
- Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).
Mitigation MIT-26
Strategy: Compilation or Build Hardening
Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
CAPEC-128: Integer Attacks
An attacker takes advantage of the structure of integer variables to cause these variables to assume values that are not expected by an application. For example, adding one to the largest positive integer in a signed integer variable results in a negative number. Negative numbers may be illegal in an application and the application may prevent an attacker from providing them directly, but the application may not consider that adding two positive numbers can create a negative number do to the structure of integer storage formats.
CAPEC-129: Pointer Manipulation
This attack pattern involves an adversary manipulating a pointer within a target application resulting in the application accessing an unintended memory location. This can result in the crashing of the application or, for certain pointer values, access to data that would not normally be possible or the execution of arbitrary code. Since pointers are simply integer variables, Integer Attacks may often be used in Pointer Attacks.