Inefficient CPU Computation

Opis

The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further.

Skutki

• Availability

  Reduce Performance; DoS: Resource Consumption (CPU)

  This issue can make the product perform more slowly, possibly in ways that are noticeable to the users. If an attacker can influence the amount of computation that must be performed, e.g. by triggering worst-case complexity, then this performance problem might introduce a vulnerability.

Przykłady podatności

• CVE-2022-37734 Chain: lexer in Java-based GraphQL server does not enforce maximum of tokens early enough (CWE-696), allowing excessive CPU consumption (CWE-1176)

Słabość nadrzędna

• CWE-405 Asymmetric Resource Consumption (Amplification)

Słabości podrzędne

• CWE-1042 Static Member Data Element outside of a Singleton Class Element
• CWE-1046 Creation of Immutable Text Using String Concatenation
• CWE-1049 Excessive Data Query Operations in a Large Data Table
• CWE-1063 Creation of Class Instance within a Static Code Block
• CWE-1067 Excessive Execution of Sequential Searches of Data Resource

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific

Źródła

1. Computational complexity theory) — Wikipedia