CWE-1335 Detail

CWE-1335

Incorrect Bitwise Shift of Integer
Draft
2021-07-20
00h00 +00:00
2023-06-29
00h00 +00:00
CWE Mitre.org
Notifications for a CWE
Stay informed of any changes for a specific CWE.
Notifications manage

Name: Incorrect Bitwise Shift of Integer

An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.

CWE Description

Specifying a value to be shifted by a negative amount is undefined in various languages. Various computer architectures implement this action in different ways. The compilers and interpreters when generating code to accomplish a shift generally do not do a check for this issue.

Specifying an over-shift, a shift greater than or equal to the number of bits contained in a value to be shifted, produces a result which varies by architecture and compiler. In some languages, this action is specifically listed as producing an undefined result.

General Informations

Modes Of Introduction

Implementation : Adding shifts without properly verifying the size and sign of the shift amount.

Applicable Platforms

Language

Name: C (Undetermined)
Name: C++ (Undetermined)
Name: C# (Undetermined)
Name: Java (Undetermined)
Name: JavaScript (Undetermined)

Operating Systems

Class: Not OS-Specific (Undetermined)

Technologies

Class: Not Technology-Specific (Undetermined)

Common Consequences

Scope Impact Likelihood
IntegrityDoS: Crash, Exit, or Restart

Observed Examples

References Description

CVE-2009-4307

An unexpected large value in the ext4 filesystem causes an overshift condition resulting in a divide by zero.

CVE-2012-2100

An unexpected large value in the ext4 filesystem causes an overshift condition resulting in a divide by zero - fix of CVE-2009-4307.

CVE-2020-8835

An overshift in a kernel allowed out of bounds reads and writes resulting in a root takeover.

CVE-2015-1607

Program is not properly handling signed bitwise left-shifts causing an overlapping memcpy memory range error.

CVE-2016-9842

Compression function improperly executes a signed left shift of a negative integer.

CVE-2018-18445

Some kernels improperly handle right shifts of 32 bit numbers in a 64 bit register.

CVE-2013-4206

Putty has an incorrectly sized shift value resulting in an overshift.

CVE-2018-20788

LED driver overshifts under certain conditions resulting in a DoS.

Potential Mitigations

Phases : Implementation
Implicitly or explicitly add checks and mitigation for negative or over-shift values.

Vulnerability Mapping Notes

Justification : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comment : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Submission

Name Organization Date Date release Version
CWE Content Team MITRE 2021-03-29 +00:00 2021-07-20 +00:00 4.5

Modifications

Name Organization Date Comment
CWE Content Team MITRE 2022-10-13 +00:00 updated Demonstrative_Examples, Observed_Examples
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes