CWE-622: Improper Validation of Function Hook Arguments Improper Validation of Function Hook Arguments
Weakness ID: 622 (Weakness Variant) Status: Draft
Description
Description Summary
A product adds hooks to user-accessible API functions, but does not properly validate the arguments. This could lead to resultant vulnerabilities.
Extended Description
Such hooks can be used in defensive software that runs with privileges, such as anti-virus or firewall, which hooks kernel calls. When the arguments are not validated, they could be used to bypass the protection scheme or attack the product itself.
Time of Introduction
Common Consequences
Scope Effect Integrity
Technical Impact: Unexpected state
Observed Examples
Reference Description CVE-2007-0708 DoS in firewall using standard Microsoft
functions CVE-2006-7160 DoS in firewall using standard Microsoft
functions CVE-2007-1376 function does not verify that its argument is the
proper type, leading to arbitrary memory
write CVE-2007-1220 invalid syscall arguments bypass code execution
limits CVE-2006-4541 DoS in IDS via NULL
argument
Potential Mitigations
Phase: Architecture and Design
Ensure that all arguments are verified, as defined by the API you are
protecting.
Phase: Architecture and Design
Drop privileges before invoking such functions, if possible.
Weakness Ordinalities
Ordinality Description Primary
(where
the weakness exists independent of other weaknesses)
Relationships
Nature Type ID Name View(s) this relationship pertains to ChildOf Weakness Class 20 Improper Input Validation Development Concepts (primary) 699
Research Concepts (primary) 1000
ChildOf Category 896 SFP Cluster: Tainted Input Software Fault Pattern (SFP) Clusters (primary) 888
Content History
Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Time_of_Introduction 2008-09-08 CWE Content Team MITRE Internal updated Description, Relationships, Observed_Example,
Other_Notes 2009-12-28 CWE Content Team MITRE Internal updated Other_Notes,
Weakness_Ordinalities 2010-09-27 CWE Content Team MITRE Internal updated Relationships 2011-06-01 CWE Content Team MITRE Internal updated Common_Consequences 2011-06-27 CWE Content Team MITRE Internal updated Common_Consequences 2012-05-11 CWE Content Team MITRE Internal updated Relationships 2012-10-30 CWE Content Team MITRE Internal updated Name, Potential_Mitigations Previous Entry Names Change Date Previous Entry
Name 2012-10-30 Unvalidated Function Hook
Arguments
Description
