Compiler Optimization Removal or Modification of Security-critical Code

Opis

The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.

Skutki

• Access Control, Other

  Bypass Protection Mechanism; Alter Execution Logic

Przykłady podatności

• CVE-2008-1685 C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.
• CVE-2019-1010006 Chain: compiler optimization (CWE-733) removes or modifies code used to detect integer overflow (CWE-190), allowing out-of-bounds write (CWE-787).

Słabość nadrzędna

• CWE-1038 Insecure Automated Optimizations

Słabości podrzędne

• CWE-14 Compiler Removal of Code to Clear Buffers

Kiedy powstaje

• Build and Compilation

Dotyczy

C, C++, Compiled

Źródła

1. Writing Secure Code — Michael Howard, David LeBlanc, Chapter 9, "A Compiler Optimization Caveat" Page 322, Microsoft Press, 2002