CWE-192 Integer Coercion Error

Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.

• Availability: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Crash, Exit, or Restart — Integer coercion often leads to undefined states of execution resulting in infinite loops or crashes. • Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands — In some cases, integer coercion errors can lead to exploitable buffer overflow conditions, resulting in the execution of arbitrary code. • Integrity, Other: Other — Integer coercion errors result in an incorrect value being stored for the variable in question, or possible violating integrity of the data.

• [Requirements] A language which throws exceptions on ambiguous data casts might be chosen. • [Architecture and Design] Design objects and program flow such that multiple or complex casts are unnecessary • [Implementation] Ensure that any data type casting that you must use is entirely understood in order to reduce the plausibility of error in use.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2022-2639: Chain: integer coercion error (CWE-192) prevents a return value from indicating an error, leading to out-of-bounds write (CWE-787)