CWE - CWE-622: Unvalidated Function Hook Arguments (1.1)

Home > CWE List > CWE- Individual Dictionary Definition (1.1)

CWE List
Full Dictionary View
Development View
Research View
Reports

About
Sources
Process
Documents

Community
Related Activities
Discussion List
Research
CWSS

News
Calendar
Free Newsletter

Compatibility
Program
Requirements
Declarations
Make a Declaration

Contact Us
Search the Site

CWE-622: Unvalidated Function Hook Arguments

Individual Definition in a New Window

Unvalidated Function Hook Arguments

Status: Draft

Weakness ID: 622 (Weakness Variant)

Description

Summary

A product adds hooks to user-accessible API functions, but does not properly validate the arguments. This could lead to resultant vulnerabilities.

Extended Description

Such hooks can be used in defensive software that runs with privileges, such as anti-virus or firewall, which hooks kernel calls. When the arguments are not validated, they could be used to bypass the protection scheme or attack the product itself.

Potential Mitigations

Ensure that all arguments are verified, as defined by the API you are protecting.

Drop privileges before invoking such functions, if possible.

Observed Examples

Reference	Description
CVE-2006-4541	DoS in IDS via NULL argument
CVE-2006-7160	DoS in firewall using standard Microsoft functions
CVE-2007-0708	DoS in firewall using standard Microsoft functions
CVE-2007-1220	invalid syscall arguments bypass code execution limits
CVE-2007-1376	function does not verify that its argument is the proper type, leading to arbitrary memory write

Other Notes

This weakness is usually primary.

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Weakness Base	88	Argument Injection or Modification	Research Concepts (primary)1000
ChildOf	Weakness Class	20	Insufficient Input Validation	Development Concepts (primary)699

Applicable Platforms

Languages

All

Time of Introduction

Implementation

Content History

Modifications

Eric Dalci. Cigital. 2008-07-01. (External)

updated Time_of_Introduction

CWE Content Team. MITRE. 2008-09-08. (Internal)

updated Description, Relationships, Observed_Example, Other_Notes

Page Last Updated: November 24, 2008


	CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is hosted by The MITRE Corporation. Copyright 2008, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information.	Privacy policy Terms of use Contact us