1650
Relationship
This can be primary to many other weaknesses when the programmer assumes that the IOCTL
can only be accessed by trusted parties. For example, a program or driver might not validate
incoming addresses in METHOD_NEITHER IOCTLs in Windows environments (CWE-781),
which could allow buffer overflow and similar attacks to take place, even when the attacker never
should have been able to access the IOCTL at all.
Applicable Platform
Because IOCTL functionality is typically performing low-level actions and closely interacts
with the operating system, this weakness may only appear in code that is written in low-level
languages.
References
[REF-701]Microsoft. "Securing Device Objects". < https://learn.microsoft.com/en-us/windowshardware/
drivers/kernel/controlling-device-access >.2023-04-07.
CWE-783: Operator Precedence Logic Error
Weakness ID : 783
Structure : Simple
Abstraction : Base
Description
The product uses an expression in which operator precedence causes incorrect logic to be used.
Extended Description
While often just a bug, operator precedence logic errors can have serious consequences if they are
used in security-critical code, such as making an authentication decision.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 670 Always-Incorrect Control Flow Implementation 1475
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 438 Behavioral Problems 2326
MemberOf 569 Expression Issues 2330
Applicable Platforms
Language : C (Prevalence = Rarely)
Language : C++ (Prevalence = Rarely)
Language : Not Language-Specific (Prevalence = Rarely)
Likelihood Of Exploit
Low
Common Consequences
CWE Version 4.14
CWE-783: Operator Precedence Logic Error
CWE-783: Operator Precedence Logic Error