Expected Behavior Violation

Opis

A feature, API, or function does not perform according to its specification.

Skutki

• Other

  Quality Degradation; Varies by Context

Przykłady podatności

• CVE-2003-0187 Program uses large timeouts on unconfirmed connections resulting from inconsistency in linked lists implementations.
• CVE-2003-0465 "strncpy" in Linux kernel acts different than libc on x86, leading to expected behavior difference - sort of a multiple interpretation error?
• CVE-2005-3265 Buffer overflow in product stems the use of a third party library function that is expected to have internal protection against overflows, but doesn't.

Słabość nadrzędna

• CWE-684 Incorrect Provision of Specified Functionality

Słabości podrzędne

• CWE-1434 Insecure Setting of Generative AI/ML Model Inference Parameters

Kiedy powstaje

• Architecture and Design
• Implementation
• Operation

Dotyczy

Not Language-Specific, ICS/OT

Uwagi

The behavior of an application that is not consistent with the expectations of the developer may lead to incorrect use of the software.

Źródła

1. The RISC-V Instruction Set Manual Volume II: Privileged Architecture page 28 — 2021
2. csr_regfile.sv — 2021
3. Fix for csr_regfile.sv — 2021