CWE-190: Integer Overflow or Wraparound
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
常见后果
影响范围: Availability
技术影响: DoS: Crash, Exit, or Restart DoS: Resource Consumption (Memory) DoS: Instability
说明: This weakness can generally lead to undefined behavior and therefore crashes. When the calculated result is used for resource allocation, this weakness can cause too many (or too few) resources to be allocated, possibly enabling crashes if the product requests more resources than can be provided.
影响范围: Integrity
技术影响: Modify Memory
说明: If the value in question is important to data (as opposed to flow), simple data corruption has occurred. Also, if the overflow/wraparound results in other conditions such as buffer overflows, further memory corruption may occur.
影响范围: Confidentiality Availability Access Control
技术影响: Execute Unauthorized Code or Commands Bypass Protection Mechanism
说明: This weakness can sometimes trigger buffer overflows, which can be used to execute arbitrary code. This is usually outside the scope of the product's implicit security policy.
影响范围: Availability Other
技术影响: Alter Execution Logic DoS: Crash, Exit, or Restart DoS: Resource Consumption (CPU)
说明: If the overflow/wraparound occurs in a loop index variable, this could cause the loop to terminate at the wrong time - too early, too late, or not at all (i.e., infinite loops). With too many iterations, some loops could consume too many resources such as memory, file handles, etc., possibly leading to a crash or other DoS.
影响范围: Access Control
技术影响: Bypass Protection Mechanism
说明: If integer values are used in security-critical decisions, such as calculating quotas or allocation limits, integer overflows can be used to cause an incorrect security decision.
潜在缓解措施
阶段: Requirements
描述: Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
阶段: Requirements
策略: Language Selection
阶段: Architecture and Design
策略: Libraries or Frameworks
阶段: Implementation
策略: Input Validation
阶段: Implementation
阶段: Architecture and Design
描述: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
阶段: Implementation
策略: Compilation or Build Hardening
描述: Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.
检测方法
方法: Automated Static Analysis
This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives.
有效性: High
方法: Black Box
Sometimes, evidence of this weakness can be detected using dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
有效性: Moderate
方法: Manual Analysis
有效性: High
方法: Automated Static Analysis - Binary or Bytecode
有效性: High
方法: Dynamic Analysis with Manual Results Interpretation
有效性: SOAR Partial
方法: Manual Static Analysis - Source Code
有效性: SOAR Partial
方法: Automated Static Analysis - Source Code
有效性: High
方法: Architecture or Design Review
有效性: High
观察示例
参考: CVE-2025-27363
Font rendering library does not properly handle assigning a signed short value to an unsigned long (CWE-195), leading to an integer wraparound (CWE-190), causing too small of a buffer (CWE-131), leading to an out-of-bounds write (CWE-787).
参考: CVE-2021-43537
Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cause heap memory corruption (CWE-122)
参考: CVE-2019-19911
Chain: Python library does not limit the resources used to process images that specify a very large number of bands (CWE-1284), leading to excessive memory consumption (CWE-789) or an integer overflow (CWE-190).
参考: CVE-2022-0545
Chain: 3D renderer has an integer overflow (CWE-190) leading to write-what-where condition (CWE-123) using a crafted image.
参考: CVE-2021-30860
Chain: improper input validation (CWE-20) leads to integer overflow (CWE-190) in mobile OS, as exploited in the wild per CISA KEV.
参考: CVE-2021-30663
Chain: improper input validation (CWE-20) leads to integer overflow (CWE-190) in mobile OS, as exploited in the wild per CISA KEV.
参考: CVE-2018-10887
Chain: unexpected sign extension (CWE-194) leads to integer overflow (CWE-190), causing an out-of-bounds read (CWE-125)
参考: CVE-2019-1010006
Chain: compiler optimization (CWE-733) removes or modifies code used to detect integer overflow (CWE-190), allowing out-of-bounds write (CWE-787).
参考: CVE-2010-1866
Chain: integer overflow (CWE-190) causes a negative signed value, which later bypasses a maximum-only check (CWE-839), leading to heap-based buffer overflow (CWE-122).
参考: CVE-2010-2753
Chain: integer overflow leads to use-after-free
参考: CVE-2005-1513
Chain: integer overflow in securely-coded mail program leads to buffer overflow. In 2005, this was regarded as unrealistic to exploit, but in 2020, it was rediscovered to be easier to exploit due to evolutions of the technology.
参考: CVE-2002-0391
Integer overflow via a large number of arguments.
参考: CVE-2002-0639
Integer overflow in OpenSSH as listed in the demonstrative examples.
参考: CVE-2005-1141
Image with large width and height leads to integer overflow.
参考: CVE-2005-0102
Length value of -1 leads to allocation of 0 bytes and resultant heap overflow.
参考: CVE-2004-2013
Length value of -1 leads to allocation of 0 bytes and resultant heap overflow.
参考: CVE-2017-1000121
chain: unchecked message size metadata allows integer overflow (CWE-190) leading to buffer overflow (CWE-119).
参考: CVE-2013-1591
Chain: an integer overflow (CWE-190) in the image size calculation causes an infinite loop (CWE-835) which sequentially allocates buffers without limits (CWE-1325) until the stack is full.
引入模式
| 阶段 | 说明 |
|---|---|
| Implementation | This weakness may become security critical when determining the offset or size in behaviors such as memory allocation, copying, and concatenation. |
适用平台
编程语言
分类映射
| 分类名称 | 条目ID | 条目名称 | 映射适配度 |
|---|---|---|---|
| PLOVER | - | Integer overflow (wrap or wraparound) | - |
| 7 Pernicious Kingdoms | - | Integer Overflow | - |
| CLASP | - | Integer overflow | - |
| CERT C Secure Coding | INT18-C | Evaluate integer expressions in a larger size before comparing or assigning to that size | CWE More Abstract |
| CERT C Secure Coding | INT30-C | Ensure that unsigned integer operations do not wrap | CWE More Abstract |
| CERT C Secure Coding | INT32-C | Ensure that operations on signed integers do not result in overflow | Imprecise |
| CERT C Secure Coding | INT35-C | Evaluate integer expressions in a larger size before comparing or assigning to that size | - |
| CERT C Secure Coding | MEM07-C | Ensure that the arguments to calloc(), when multiplied, do not wrap | CWE More Abstract |
| CERT C Secure Coding | MEM35-C | Allocate sufficient memory for an object | - |
| WASC | 3 | Integer Overflows | - |
| Software Fault Patterns | SFP1 | Glitch in computation | - |
| ISA/IEC 62443 | Part 3-3 | Req SR 3.5 | - |
| ISA/IEC 62443 | Part 3-3 | Req SR 7.2 | - |
| ISA/IEC 62443 | Part 4-1 | Req SR-2 | - |
| ISA/IEC 62443 | Part 4-1 | Req SI-2 | - |
| ISA/IEC 62443 | Part 4-1 | Req SVV-1 | - |
| ISA/IEC 62443 | Part 4-1 | Req SVV-3 | - |
| ISA/IEC 62443 | Part 4-2 | Req CR 3.5 | - |
| ISA/IEC 62443 | Part 4-2 | Req CR 7.2 | - |