CWE-128 — Wrap-around Error
CWE-128: Wrap-around Error
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Incomplete |
| Likelihood of exploit | Medium |
Description
Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore "wraps around" to a very small, negative, or undefined value.
Common consequences
- Availability: DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Instability
- Integrity: Modify Memory
- Confidentiality, Availability, Access Control: Execute Unauthorized Code or Commands, Bypass Protection Mechanism
Mitigations
General — Requirements specification: The choice could be made to use a language that is not susceptible to these issues.
Architecture and Design — Provide clear upper and lower bounds on the scale of any protocols designed.
Implementation — Perform validation on all incremented variables to ensure that they remain within reasonable bounds.
References
- CWE page: https://cwe.mitre.org/data/definitions/128.html
- CWE list: https://cwe.mitre.org/data/index.html