1. Home
  2. CWE Database
  3. CWE-1105
Base · Medium

CWE-1105: Insufficient Encapsulation of Machine-Dependent Functionality

The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the rest of the code.

CWE-1105 · Base Level

Description

The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the rest of the code.

Potential Impact

Other

Reduce Maintainability

Demonstrative Examples

In this example function, the memory address of variable b is derived by adding 1 to the address of variable a. This derived address is then used to assign the value 0 to b.
Bad
void example() {char a;char b;*(&a + 1) = 0;}
Here, b may not be one byte past a. It may be one byte in front of a. Or, they may have three bytes between them because they are aligned on 32-bit boundaries.

Detection Methods

  • Automated Static Analysis — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

The product uses an API function, data structure, or other entity in a way that relies on properties that are not always...

CWE-1061: Insufficient Encapsulation

The product does not sufficiently hide the internal representation and implementation details of data or methods, which ...

Frequently Asked Questions

What is CWE-1105?

CWE-1105 (Insufficient Encapsulation of Machine-Dependent Functionality) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the rest of the code.

How can CWE-1105 be exploited?

Attackers can exploit CWE-1105 (Insufficient Encapsulation of Machine-Dependent Functionality) to reduce maintainability. This weakness is typically introduced during the Implementation, Porting phase of software development.

How do I prevent CWE-1105?

Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.

What is the severity of CWE-1105?

CWE-1105 is classified as a Base-level weakness (Medium abstraction). Its actual severity depends on the specific context and how the weakness manifests in your application.