CWE - CWE-622: Unvalidated Function Hook Arguments (1.6)

Home > CWE List > CWE- Individual Dictionary Definition (1.6)

CWE List
Full Dictionary View
Development View
Research View
Reports

About
Sources
Process
Documents

Community
Related Activities
Discussion List
Research
CWE/SANS Top 25
CWSS

News
Calendar
Free Newsletter

Compatibility
Program
Requirements
Declarations
Make a Declaration

Contact Us
Search the Site

CWE-622: Unvalidated Function Hook Arguments

Unvalidated Function Hook Arguments

Weakness ID: 622 (Weakness Variant)

Status: Draft

Description

Description Summary

A product adds hooks to user-accessible API functions, but does not properly validate the arguments. This could lead to resultant vulnerabilities.

Extended Description

Such hooks can be used in defensive software that runs with privileges, such as anti-virus or firewall, which hooks kernel calls. When the arguments are not validated, they could be used to bypass the protection scheme or attack the product itself.

Time of Introduction

Implementation

Applicable Platforms

Languages

All

Observed Examples

Reference	Description
CVE-2007-0708	DoS in firewall using standard Microsoft functions
CVE-2006-7160	DoS in firewall using standard Microsoft functions
CVE-2007-1376	function does not verify that its argument is the proper type, leading to arbitrary memory write
CVE-2007-1220	invalid syscall arguments bypass code execution limits
CVE-2006-4541	DoS in IDS via NULL argument

Potential Mitigations

Phase	Description
	Ensure that all arguments are verified, as defined by the API you are protecting.
	Drop privileges before invoking such functions, if possible.

Other Notes

This weakness is usually primary.

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Weakness Class	20	Improper Input Validation	Development Concepts (primary)699
ChildOf	Weakness Base	88	Argument Injection or Modification	Research Concepts (primary)1000

Content History

Modifications
Modification Date	Modifier	Organization	Source
2008-07-01	Eric Dalci	Cigital	External
2008-07-01	updated Time of Introduction
2008-09-08	CWE Content Team	MITRE	Internal
2008-09-08	updated Description, Relationships, Observed Example, Other Notes

Page Last Updated: October 29, 2009


	CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is hosted by The MITRE Corporation. Copyright 2009, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information.	Privacy policy Terms of use Contact us