CWE-822 Untrusted Pointer Dereference

The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

• Confidentiality: Read Memory — If the dereferencing operation is for a read, then the attack might allow reading of sensitive data, cause a crash, or set a variable to an unexpected value (since the value will be read from an unexpected memory location). • Availability: DoS: Crash, Exit, or Restart — If the untrusted pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" or larger than expected by a read or write operation, the application may terminate unexpectedly. • Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands, Modify Memory — If the pointer is dereferenced for a write operation, the attack might allow modification of critical state variables, cause a crash, or execute code. If the untrusted pointer is used in a function call, then the attacker might be able to call arbitrary functions.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) • Automated Dynamic Analysis: Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].

• CVE-2007-5655: message-passing framework interprets values in packets as pointers, causing a crash. • CVE-2010-2299: labeled as a "type confusion" issue, also referred to as a "stale pointer." However, the bug ID says "contents are simply interpreted as a pointer... renderer ordinarily doesn't supply this pointer directly". The "handle" in the untrusted area is replaced in one function, but not another - thus also, effectively, exposure to wrong sphere (CWE-668). • CVE-2009-1719: Untrusted dereference using undocumented constructor. • CVE-2009-1250: An error code is incorrectly checked and interpreted as a pointer, leading to a crash. • CVE-2009-0311: An untrusted value is obtained from a packet and directly called as a function pointer, leading to code execution. • CVE-2010-1818: Undocumented attribute in multimedia software allows "unmarshaling" of an untrusted pointer. • CVE-2010-3189: ActiveX control for security software accepts a parameter that is assumed to be an initialized pointer. • CVE-2010-1253: Spreadsheet software treats certain record values that lead to "user-controlled pointer" (might be an untrusted offset, not an untrusted pointer).