CWEweakness

CWE-622 Improper Validation of Function Hook Arguments

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product adds hooks to user-accessible API functions, but it does not properly validate the arguments.

Common consequences

• Integrity: Unexpected State, Bypass Protection Mechanism — When the arguments are not validated, they could be used to bypass the protection mechanism or attack the product itself. This could lead to resultant vulnerabilities.

Potential mitigations

• [Architecture and Design] Ensure that all arguments are verified, as defined by the API you are protecting. • [Architecture and Design] Drop privileges before invoking such functions, if possible.

Observed examples

• CVE-2007-0708: DoS in firewall using standard Microsoft functions • CVE-2006-7160: DoS in firewall using standard Microsoft functions • CVE-2007-1376: function does not verify that its argument is the proper type, leading to arbitrary memory write • CVE-2007-1220: invalid syscall arguments bypass code execution limits • CVE-2006-4541: DoS in IDS via NULL argument

Related

Observed example · CVE (5)

  • CVE-2007-1376 The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop… vulnerability
  • CVE-2006-7160 The Sandbox.sys driver in Outpost Firewall PRO 4.0, and possibly earlier versions, does not validate arguments to hooked SSDT functions,… vulnerability
  • CVE-2007-1220 The Hypervisor in Microsoft Xbox 360 kernel 4532 and 4548 does not properly verify the parameters passed to the syscall dispatcher, which… vulnerability
  • CVE-2007-0708 cmdmon.sys in Comodo Firewall Pro (formerly Comodo Personal Firewall) before 2.4.16.174 does not validate arguments that originate in user… vulnerability
  • CVE-2006-4541 RapDrv.sys in BlackICE PC Protection 3.6.cpn, cpj, cpiE, and possibly 3.6 and earlier, allows local users to cause a denial of service… vulnerability

Child of · CWE (1)

  • CWE-20 Improper Input Validation weakness

Referenced by CVE · weakness (2)

  • CVE-2024-0311 A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code. vulnerability
  • CVE-2024-0312 A malicious insider can uninstall Skyhigh Client Proxy without a valid uninstall password. vulnerability