Insecure Automated Optimizations

Opis

The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.

Skutki

• Integrity

  Alter Execution Logic

  The optimizations alter the order of execution resulting in side effects that were not intended by the original developer.

Przykłady podatności

• CVE-2017-5715 Intel, ARM, and AMD processor optimizations related to speculative execution and branch prediction cause access control checks to be bypassed when placing data into the cache. Often known as "Spectre".
• CVE-2008-1685 C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.

Słabość nadrzędna

• CWE-435 Improper Interaction Between Multiple Correctly-Behaving Entities
• CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Słabości podrzędne

• CWE-733 Compiler Optimization Removal or Modification of Security-critical Code
• CWE-1037 Processor Optimization Removal or Modification of Security-critical Code

Kiedy powstaje

• Architecture and Design — Optimizations built into the design of a product can have unintended consequences during execution.

Dotyczy

Not Language-Specific