1. Home
  2. CWE Database
  3. CWE-354
Base · Medium

CWE-354: Improper Validation of Integrity Check Value

The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmis...

CWE-354 · Base Level ·1 CVEs ·1 Mitigations

Description

The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Improper validation of checksums before use results in an unnecessary risk that can easily be mitigated. The protocol specification describes the algorithm used for calculating the checksum. It is then a simple matter of implementing the calculation and verifying that the calculated checksum and the received checksum match. Improper verification of the calculated checksum and the received checksum can lead to far greater consequences.

Potential Impact

Integrity, Other

Modify Application Data, Other

Integrity, Other

Other

Non-Repudiation, Other

Hide Activities, Other

Demonstrative Examples

The following example demonstrates the weakness.
Bad
sd = socket(AF_INET, SOCK_DGRAM, 0); serv.sin_family = AF_INET;serv.sin_addr.s_addr = htonl(INADDR_ANY);servr.sin_port = htons(1008);bind(sd, (struct sockaddr *) & serv, sizeof(serv));while (1) {
                        
                           memset(msg, 0x0, MAX_MSG);clilen = sizeof(cli);if (inet_ntoa(cli.sin_addr)==...) n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen);
                     }
Bad
while(true) {DatagramPacket packet = new DatagramPacket(data,data.length,IPAddress, port);socket.send(sendPacket);}

Mitigations & Prevention

Implementation

Ensure that the checksums present in messages are properly checked in accordance with the protocol specification before they are parsed and used.

Real-World CVE Examples

CVE IDDescription
CVE-2024-47573network analysis tool does not properly validate an integrity check value, allowing installation of malicious firmware

CWE-345: Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid d...

CWE-754: Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur fr...

CWE-353: Missing Support for Integrity Check

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data durin...

Taxonomy Mappings

  • ISA/IEC 62443: Part 3-3 — Req SR 3.1
  • CLASP: — Failure to check integrity check value

Frequently Asked Questions

What is CWE-354?

CWE-354 (Improper Validation of Integrity Check Value) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmis...

How can CWE-354 be exploited?

Attackers can exploit CWE-354 (Improper Validation of Integrity Check Value) to modify application data, other. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.

How do I prevent CWE-354?

Key mitigations include: Ensure that the checksums present in messages are properly checked in accordance with the protocol specification before they are parsed and used.

What is the severity of CWE-354?

CWE-354 is classified as a Base-level weakness (Medium abstraction). It has been observed in 1 real-world CVEs.