2237
Example Language: C (Bad)
int choose_bit(int reg_bit, int bit_number_from_elsewhere)
{
if (NEED_TO_SHIFT)
{
reg_bit -= bit_number_from_elsewhere;
}
return reg_bit;
}
unsigned int handle_io_register(unsigned int *r)
{
unsigned int the_bit = 1 << choose_bit(5, 10);
*r |= the_bit;
return the_bit;
}
Example Language: C (Good)
int choose_bit(int reg_bit, int bit_number_from_elsewhere)
{
if (NEED_TO_SHIFT)
{
reg_bit -= bit_number_from_elsewhere;
}
return reg_bit;
}
unsigned int handle_io_register(unsigned int *r)
{
int the_bit_number = choose_bit(5, 10);
if ((the_bit_number > 0) && (the_bit_number < 63))
{
unsigned int the_bit = 1 << the_bit_number;
*r |= the_bit;
}
return the_bit;
}
Note that the good example not only checks for negative shifts and disallows them, but it also
checks for over-shifts. No bit operation is done if the shift is out of bounds. Depending on the
program, perhaps an error message should be logged.
Observed Examples
Reference Description
CVE-2009-4307 An unexpected large value in the ext4 filesystem causes an overshift condition
resulting in a divide by zero.
https://www.cve.org/CVERecord?id=CVE-2009-4307
CVE-2012-2100 An unexpected large value in the ext4 filesystem causes an overshift condition
resulting in a divide by zero - fix of CVE-2009-4307.
https://www.cve.org/CVERecord?id=CVE-2012-2100
CVE-2020-8835 An overshift in a kernel allowed out of bounds reads and writes resulting in a
root takeover.
https://www.cve.org/CVERecord?id=CVE-2020-8835
CVE-2015-1607 Program is not properly handling signed bitwise left-shifts causing an
overlapping memcpy memory range error.
https://www.cve.org/CVERecord?id=CVE-2015-1607
CVE-2016-9842 Compression function improperly executes a signed left shift of a negative
integer.
https://www.cve.org/CVERecord?id=CVE-2016-9842
CVE-2018-18445 Some kernels improperly handle right shifts of 32 bit numbers in a 64 bit
register.
https://www.cve.org/CVERecord?id=CVE-2018-18445
CWE Version 4.14
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
CWE-1336: Improper Neutralization of
Special Elements Used in a Template Engine 2238
Reference Description
CVE-2013-4206 Putty has an incorrectly sized shift value resulting in an overshift.
https://www.cve.org/CVERecord?id=CVE-2013-4206
CVE-2018-20788 LED driver overshifts under certain conditions resulting in a DoS.
https://www.cve.org/CVERecord?id=CVE-2018-20788
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1408 Comprehensive Categorization: Incorrect Calculation 1400 2534
CWE-1336: Improper Neutralization of Special Elements Used in a Template
Engine
Weakness ID : 1336
Structure : Simple
Abstraction : Base
Description
The product uses a template engine to insert or process externally-influenced input, but it does not
neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template
expressions or other code directives when processed by the engine.
Extended Description
Many web applications use template engines that allow developers to insert externally-influenced
values into free text or messages in order to generate a full web page, document, message, etc.
Such engines include Twig, Jinja2, Pug, Java Server Pages, FreeMarker, Velocity, ColdFusion,
Smarty, and many others - including PHP itself. Some CMS (Content Management Systems) also
use templates.
Template engines often have their own custom command or expression language. If an attacker
can influence input into a template before it is processed, then the attacker can invoke arbitrary
expressions, i.e. perform injection attacks. For example, in some template languages, an attacker
could inject the expression "{{7*7}}" and determine if the output returns "49" instead. The syntax
varies depending on the language.
In some cases, XSS-style attacks can work, which can obscure the root cause if the developer
does not closely investigate the root cause of the error.
Template engines can be used on the server or client, so both "sides" could be affected by
injection. The mechanisms of attack or the affected technologies might be different, but the mistake
is fundamentally the same.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 94 Improper Control of Generation of Code ('Code Injection') 219
CWE Version 4.14
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
CWE-1336: Improper Neutralization of
Special Elements Used in a Template Engine