CWE-839 Numeric Range Comparison Without Minimum Check

The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.

• Confidentiality, Integrity: Modify Memory, Read Memory — If a negative value is used to access memory, buffers, or other indexable structures, it could access memory outside the bounds of the buffer. • Availability: DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other) — In some contexts, a negative value could lead to resource consumption, e.g., if the negative value is used for memory allocation. • Integrity, Confidentiality, Availability: Modify Application Data, Execute Unauthorized Code or Commands — An attacker could modify the structure of the message or data being sent to the downstream component, possibly injecting commands. • Integrity: Varies by Context, Unexpected State — The use of a negative number in a positive-only context could have security implications for other types of resources. For example, a shopping cart might check that the user is not requesting more than 10 items, but a request for -3 items could cause the application to calculate a negative price and credit the attacker's account.

• [Implementation] If the number to be used is always expected to be positive, change the variable type from signed to unsigned or size_t. • [Implementation] If the number to be used could have a negative value based on the specification (thus requiring a signed value), but the number should only be positive to preserve code correctness, then include a check to ensure that the value is positive.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2010-1866: Chain: integer overflow (CWE-190) causes a negative signed value, which later bypasses a maximum-only check (CWE-839), leading to heap-based buffer overflow (CWE-122). • CVE-2009-1099: Chain: 16-bit counter can be interpreted as a negative value, compared to a 32-bit maximum value, leading to buffer under-write. • CVE-2011-0521: Chain: kernel's lack of a check for a negative value leads to memory corruption. • CVE-2010-3704: Chain: parser uses atoi() but does not check for a negative value, which can happen on some platforms, leading to buffer under-write. • CVE-2010-2530: Chain: Negative value stored in an int bypasses a size check and causes allocation of large amounts of memory. • CVE-2009-3080: Chain: negative offset value to IOCTL bypasses check for maximum index, then used as an array index for buffer under-read. • CVE-2008-6393: Chain: file transfer client performs signed comparison, leading to integer overflow and heap-based buffer overflow. • CVE-2008-4558: Chain: negative ID in media player bypasses check for maximum index, then used as an array index for buffer under-read.