1153
Example Language: Verilog (Good)
module csr_regfile #(
...
// check that we actually want to enter debug depending on the privilege level we are currently in
unique case (priv_lvl_o)
riscv::PRIV_LVL_M: begin
debug_mode_d = dcsr_q.ebreakm;
...
riscv::PRIV_LVL_U: begin
debug_mode_d = dcsr_q.ebreaku;
...
assign priv_lvl_o = (debug_mode_q && umode_i) ? riscv::PRIV_LVL_M : priv_lvl_q;
...
debug_mode_q <= debug_mode_d;
...
Observed Examples
Reference Description
CVE-2022-3979 Chain: data visualization program written in PHP uses the "!=" operator instead
of the type-strict "!==" operator (CWE-480) when validating hash values,
potentially leading to an incorrect type conversion (CWE-704)
https://www.cve.org/CVERecord?id=CVE-2022-3979
CVE-2021-3116 Chain: Python-based HTTP Proxy server uses the wrong boolean operators
(CWE-480) causing an incorrect comparison (CWE-697) that identifies an
authN failure if all three conditions are met instead of only one, allowing
bypass of the proxy authentication (CWE-1390)
https://www.cve.org/CVERecord?id=CVE-2021-3116
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 747 CERT C Secure Coding Standard (2008) Chapter 14 -
Miscellaneous (MSC)
734 2350
MemberOf 871 CERT C++ Secure Coding Section 03 - Expressions
(EXP)
868 2374
MemberOf 883 CERT C++ Secure Coding Section 49 - Miscellaneous
(MSC)
868 2381
MemberOf 884 CWE Cross-section 884 2567
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1157 SEI CERT C Coding Standard - Guidelines 03.
Expressions (EXP)
1154 2455
MemberOf 1306 CISQ Quality Measures - Reliability 1305 2483
MemberOf 1307 CISQ Quality Measures - Maintainability 1305 2484
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Using the wrong operator
CERT C Secure Coding EXP45-C CWE More
Abstract
Do not perform assignments in
selection statements
CWE Version 4.14
CWE-481: Assigning instead of Comparing
CWE-481: Assigning instead of Comparing