CWE-1335 Incorrect Bitwise Shift of Integer

An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value.

Specifying a value to be shifted by a negative amount is undefined in various languages. Various computer architectures implement this action in different ways. The compilers and interpreters when generating code to accomplish a shift generally do not do a check for this issue. Specifying an over-shift - a shift greater than or equal to the number of bits contained in a value to be shifted - produces a result that varies by architecture and compiler. In some languages, this action is undefined.

• Integrity: DoS: Crash, Exit, or Restart • Other: Undefined Behavior, Unexpected State, Alter Execution Logic

• [Implementation] Implicitly or explicitly add checks and mitigation for negative or over-shift values.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2023-4720: multimedia product performs a left shift with a negative value, leading to a crash • CVE-2009-4307: An unexpected large value in the ext4 filesystem causes an overshift condition resulting in a divide by zero. • CVE-2012-2100: An unexpected large value in the ext4 filesystem causes an overshift condition resulting in a divide by zero - fix of CVE-2009-4307. • CVE-2020-8835: An overshift in a kernel allowed out of bounds reads and writes resulting in a root takeover. • CVE-2015-1607: Program is not properly handling signed bitwise left-shifts causing an overlapping memcpy memory range error. • CVE-2016-9842: Compression function improperly executes a signed left shift of a negative integer. • CVE-2018-18445: Some kernels improperly handle right shifts of 32 bit numbers in a 64 bit register. • CVE-2013-4206: Putty has an incorrectly sized shift value resulting in an overshift. • CVE-2018-20788: LED driver overshifts under certain conditions resulting in a DoS.