The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| ChildOf | Discouraged | P | 435 | Improper Interaction Between Multiple Correctly-Behaving Entities |
| ChildOf | Allowed-with-Review | C | 758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior |
| ParentOf | Allowed | B | 1037 | Processor Optimization Removal or Modification of Security-critical Code |
| ParentOf | Allowed | B | 733 | Compiler Optimization Removal or Modification of Security-critical Code |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1398 | Comprehensive Categorization: Component Interaction |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-275 | Low likelihood of exploit |
| MemberOf | Prohibited | BS | BOSS-294 | Not Language-Specific Weaknesses |
| MemberOf | Prohibited | BS | BOSS-330 | Alter Execution Logic (impact) |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Integrity | N/A | Alter Execution Logic | The optimizations alter the order of execution resulting in side effects that were not intended by the original developer. |
The optimizations alter the order of execution resulting in side effects that were not intended by the original developer.
Optimizations built into the design of a product can have unintended consequences during execution.
| Reference | Description |
|---|---|
| CVE-2017-5715 | Intel, ARM, and AMD processor optimizations related to speculative execution and branch prediction cause access control checks to be bypassed when placing data into the cache. Often known as "Spectre". |
| CVE-2008-1685 | C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows. |
| Ordinality | Description |
|---|---|
| Primary | This weakness does not depend on other weaknesses and is the result of choices made during optimization. |
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|
| ID | Name |
|---|