2130
[REF-1107]Intel Corporation. "PCIe Device Measurement Requirements". 2018 September. <
https://www.intel.com/content/dam/www/public/us/en/documents/reference-guides/pcie-devicesecurity-
enhancements.pdf >.
[REF-1131]John Butterworth, Cory Kallenberg and Xeno Kovah. "BIOS Chronomancy: Fixing the
Core Root of Trust for Measurement". 2013 July 1. < https://media.blackhat.com/us-13/US-13-
Butterworth-BIOS-Security-Slides.pdf >.
CWE-1284: Improper Validation of Specified Quantity in Input
Weakness ID : 1284
Structure : Simple
Abstraction : Base
Description
The product receives input that is expected to specify a quantity (such as size or length), but it does
not validate or incorrectly validates that the quantity has the required properties.
Extended Description
Specified quantities include size, length, frequency, price, rate, number of operations, time, and
others. Code may rely on specified quantities to allocate resources, perform calculations, control
iteration, etc. When the quantity is not properly validated, then attackers can specify malicious
quantities to cause excessive resource allocation, trigger unexpected failures, enable buffer
overflows, etc.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
ParentOf 606 Unchecked Input for Loop Condition 1357
CanPrecede 789 Memory Allocation with Excessive Size Value 1674
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1215 Data Validation Issues 2478
MemberOf 1218 Memory Buffer Errors 2479
Applicable Platforms
Language : Not Language-Specific (Prevalence = Often)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
CWE Version 4.14
CWE-1284: Improper Validation of Specified Quantity in Input
CWE-1284: Improper Validation of Specified Quantity in Input