ByteOS Network

CAPEC-92:Forced Integer Overflow

Attack Pattern ID:92

Version:v3.9

Attack Pattern Name:Forced Integer Overflow

Abstraction:Detailed

Status:Draft

Likelihood of Attack:High

Typical Severity:High

Details Content History Related Weaknesses Reports

▼Description

This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.

▼Relationships

Nature	Type	ID	Name
ChildOf	S	128	Integer Attacks

Nature: ChildOf

Type: Standard

ID: 128

Name: Integer Attacks

▼Execution Flow

Explore

The first step is exploratory meaning the attacker looks for an integer variable that they can control.

Experiment

The attacker finds an integer variable that they can write into or manipulate and try to get the value of the integer out of the possible range.

Exploit

The integer variable is forced to have a value out of range which set its final value to an unexpected value.

The target host acts on the data and unexpected behavior may happen.

▼Prerequisites

The attacker can manipulate the value of an integer variable utilized by the target host.

The target host does not do proper range checking on the variable before utilizing it.

When the integer variable is incremented or decremented to an out of range value, it gets a very different value (e.g. very small or negative number)

▼Skills Required

Low

An attacker can simply overflow an integer by inserting an out of range value.

High

Exploiting a buffer overflow by injecting malicious code into the stack of a software system or even the heap can require a higher skill level.

▼Consequences

Scope	Likelihood	Impact	Note
Integrity	N/A	Modify Data	N/A
ConfidentialityAccess ControlAuthorization	N/A	Gain Privileges	N/A
ConfidentialityIntegrityAvailability	N/A	Execute Unauthorized Commands	Run Arbitrary Code
Confidentiality	N/A	Read Data	N/A
Availability	N/A	Unreliable Execution	N/A

Scope: Integrity

Likelihood: N/A

Impact: Modify Data

Note: N/A

Scope: Confidentiality, Access Control, Authorization

Likelihood: N/A

Impact: Gain Privileges

Note: N/A

Scope: Confidentiality, Integrity, Availability

Likelihood: N/A

Impact: Execute Unauthorized Commands

Note: Run Arbitrary Code

Scope: Confidentiality

Likelihood: N/A

Impact: Read Data

Note: N/A

Scope: Availability

Likelihood: N/A

Impact: Unreliable Execution

Note: N/A

▼Mitigations

Use a language or compiler that performs automatic bounds checking.

Carefully review the service's implementation before making it available to user. For instance you can use manual or automated code review to uncover vulnerabilities such as integer overflow.

Use an abstraction library to abstract away risky APIs. Not a complete solution.

Always do bound checking before consuming user input data.

▼Example Instances

▼Related Weaknesses

ID	Name
CWE-120	Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-122	Heap-based Buffer Overflow
CWE-128	Wrap-around Error
CWE-190	Integer Overflow or Wraparound
CWE-196	Unsigned to Signed Conversion Error
CWE-680	Integer Overflow to Buffer Overflow
CWE-697	Incorrect Comparison