1. Home
  2. CWE Database
  3. CWE-680
Compound · Complex

CWE-680: Integer Overflow to Buffer Overflow

The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.

CWE-680 · Compound Level ·2 CVEs

Description

The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.

Potential Impact

Integrity, Availability, Confidentiality

Modify Memory, DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands

Demonstrative Examples

The following image processing code allocates a table for images.
Bad
img_t table_ptr; /*struct containing img data, 10kB each*/int num_imgs;...num_imgs = get_num_imgs();table_ptr = (img_t*)malloc(sizeof(img_t)*num_imgs);...
This code intends to allocate a table of size num_imgs, however as num_imgs grows large, the calculation determining the size of the list will eventually overflow (CWE-190). This will result in a very small list to be allocated instead. If the subsequent code operates on the list as if it were num_imgs long, it may result in many types of out-of-bounds problems (CWE-119).

Detection Methods

  • Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea
  • Automated Dynamic Analysis Moderate — Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].

Real-World CVE Examples

CVE IDDescription
CVE-2021-43537Chain: in a web browser, an unsigned 64-bit integer is forcibly cast to a 32-bit integer (CWE-681) and potentially leading to an integer overflow (CWE-190). If an integer overflow occurs, this can cau
CVE-2017-1000121chain: unchecked message size metadata allows integer overflow (CWE-190) leading to buffer overflow (CWE-119).

CWE-190: Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic a...

Taxonomy Mappings

  • CERT C Secure Coding: INT30-C — Ensure that unsigned integer operations do not wrap
  • CERT C Secure Coding: INT32-C — Ensure that operations on signed integers do not result in overflow
  • CERT C Secure Coding: MEM35-C — Allocate sufficient memory for an object

Frequently Asked Questions

What is CWE-680?

CWE-680 (Integer Overflow to Buffer Overflow) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Compound-level weakness. The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.

How can CWE-680 be exploited?

Attackers can exploit CWE-680 (Integer Overflow to Buffer Overflow) to modify memory, dos: crash, exit, or restart, execute unauthorized code or commands. This weakness is typically introduced during the Implementation phase of software development.

How do I prevent CWE-680?

Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.

What is the severity of CWE-680?

CWE-680 is classified as a Compound-level weakness (Complex abstraction). It has been observed in 2 real-world CVEs.