1529
endmodule
This code uses Verilog blocking assignments for data_out and grant_access. Therefore, these
assignments happen sequentially (i.e., data_out is updated to new value first, and grant_access
is updated the next cycle) and not in parallel. Therefore, the asset data_out is allowed to be
modified even before the access control check is complete and grant_access signal is set. Since
grant_access does not have a reset value, it will be meta-stable and will randomly go to either 0 or
1.
Flipping the order of the assignment of data_out and grant_access should solve the problem. The
correct snippet of code is shown below.
Example Language: Verilog (Good)
always @ (posedge clk or negedge rst_n)
begin
if (!rst_n)
data_out = 0;
else
assign grant_access = (usr_id == 3'h4) ? 1'b1 : 1'b0;
data_out = (grant_access) ? data_in : data_out;
end
endmodule
Observed Examples
Reference Description
CVE-2019-9805 Chain: Creation of the packet client occurs before initialization is complete
(CWE-696) resulting in a read from uninitialized memory (CWE-908), causing
memory corruption.
https://www.cve.org/CVERecord?id=CVE-2019-9805
CVE-2007-5191 file-system management programs call the setuid and setgid functions in the
wrong order and do not check the return values, allowing attackers to gain
unintended privileges
https://www.cve.org/CVERecord?id=CVE-2007-5191
CVE-2007-1588 C++ web server program calls Process::setuid before calling Process::setgid,
preventing it from dropping privileges, potentially allowing CGI programs to be
called with higher privileges than intended
https://www.cve.org/CVERecord?id=CVE-2007-1588
CVE-2022-37734 Chain: lexer in Java-based GraphQL server does not enforce maximum
of tokens early enough (CWE-696), allowing excessive CPU consumption
(CWE-1176)
https://www.cve.org/CVERecord?id=CVE-2022-37734
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 748 CERT C Secure Coding Standard (2008) Appendix -
POSIX (POS)
734 2351
MemberOf 977 SFP Secondary Cluster: Design 888 2407
MemberOf 1171 SEI CERT C Coding Standard - Guidelines 50. POSIX
(POS)
1154 2463
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Taxonomy Mappings
CWE Version 4.14
CWE-697: Incorrect Comparison
CWE-697: Incorrect Comparison