Krutikp/ComplianceLLM huggingface dataset:
CWE-374: Passing Mutable Objects to an Untrusted Method (Base)

Description: The product sends non-cloned mutable data as an argument to a method or function.

Extended Description: The function or method that has been called can alter or delete the mutable data. This could violate assumptions that the calling function has made about its state. In situations where unknown code is called with references to mutable data, this external code could make changes to the data sent. If this data was not previously cloned, the modified data might not be valid in the context of execution.



Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C#:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:IMPACT:Modify Memory:NOTE:Potentially data could be tampered with by another function which should not have been tampered with.::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Pass in data which should not be altered as constant or immutable.::PHASE:Implementation:DESCRIPTION:Clone all mutable data before passing it into an external function . This is the preferred mitigation. This way, regardless of what changes are made to the data, a valid copy is retained for use by the class.::
CWE-375: Returning a Mutable Object to an Untrusted Caller (Base)

Description: Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.

Extended Description: In situations where functions return references to mutable data, it is possible that the external code which called the function may make changes to the data sent. If this data was not previously cloned, the class will then be using modified data which may violate assumptions about its internal state.



Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C#:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Access Control:SCOPE:Integrity:IMPACT:Modify Memory:NOTE:Potentially data could be tampered with by another function which should not have been tampered with.::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Declare returned data which should not be altered as constant or immutable.::PHASE:Implementation:DESCRIPTION:Clone all mutable data before returning references to it. This is the preferred mitigation. This way, regardless of what changes are made to the data, a valid copy is retained for use by the class.::
CWE-378: Creation of Temporary File With Insecure Permissions (Base)

Description: Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Application Data:NOTE:If the temporary file can be read by the attacker, sensitive information may be in that file which could be revealed.::SCOPE:Authorization:SCOPE:Other:IMPACT:Other:NOTE:If that file can be written to by the attacker, the file might be moved into a place to which the attacker does not have access. This will allow the attacker to gain selective resource access-control privileges.::SCOPE:Integrity:SCOPE:Other:IMPACT:Other:NOTE:Depending on the data stored in the temporary file, there is the potential for an attacker to gain an additional input vector which is trusted as non-malicious. It may be possible to make arbitrary changes to data structures, user information, or even process ownership.::


Potential Mitigations: ::PHASE:Requirements:DESCRIPTION:Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.::PHASE:Implementation:DESCRIPTION:Ensure that you use proper file permissions. This can be achieved by using a safe temp file function. Temporary files should be writable and readable only by the process that owns the file.::PHASE:Implementation:DESCRIPTION:Randomize temporary file names. This can also be achieved by using a safe temp-file function. This will ensure that temporary files will not be created in predictable places.::

Observed Examples: ::REFERENCE:CVE-2022-24823:DESCRIPTION:A network application framework uses the Java function createTempFile(), which will create a file that is readable by other local users of the system:LINK:https://www.cve.org/CVERecord?id=CVE-2022-24823::
CWE-379: Creation of Temporary File in Directory with Insecure Permissions (Base)

Description: The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

Extended Description: On some operating systems, the fact that the temporary file exists may be apparent to any user with sufficient privileges to access that directory. Since the file is visible, the application that is using the temporary file could be known. If one has access to list the processes on the system, the attacker has gained information about what the user is doing at that time. By correlating this with the applications the user is running, an attacker could potentially discover what a user's actions are. From this, higher levels of security could be breached.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Application Data:NOTE:Since the file is visible and the application which is using the temp file could be known, the attacker has gained information about what the user is doing at that time.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Requirements:DESCRIPTION:Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.::PHASE:Implementation:DESCRIPTION:Try to store sensitive tempfiles in a directory which is not world readable -- i.e., per-user directories.::PHASE:Implementation:DESCRIPTION:Avoid using vulnerable temp file functions.::

Observed Examples: ::REFERENCE:CVE-2022-27818:DESCRIPTION:A hotkey daemon written in Rust creates a domain socket file underneath /tmp, which is accessible by any user.:LINK:https://www.cve.org/CVERecord?id=CVE-2022-27818::REFERENCE:CVE-2021-21290:DESCRIPTION:A Java-based application for a rapid-development framework uses File.createTempFile() to create a random temporary file with insecure default permissions.:LINK:https://www.cve.org/CVERecord?id=CVE-2021-21290::
CWE-385: Covert Timing Channel (Base)

Description: Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

Extended Description: In some instances, knowing when data is transmitted between parties can provide a malicious user with privileged information. Also, externally monitoring the timing of operations can potentially reveal sensitive data. For example, a cryptographic operation can expose its internal state if the time it takes to perform the operation varies, based on the state. Covert channels are frequently classified as either storage or timing channels. Some examples of covert timing channels are the system's paging rate, the time a certain transaction requires to execute, and the time it takes to gain access to a shared bus.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Other:IMPACT:Read Application Data:IMPACT:Other:NOTE:Information exposure.::


Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Whenever possible, specify implementation strategies that do not introduce time variances in operations.::PHASE:Implementation:DESCRIPTION:Often one can artificially manipulate the time which operations take or -- when operations occur -- can remove information from the attacker.::PHASE:Implementation:DESCRIPTION:It is reasonable to add artificial or random delays so that the amount of CPU time consumed is independent of the action being taken by the application.::




Notes: ::TYPE:Maintenance:NOTE:As of CWE 4.9, members of the CWE Hardware SIG are working to improve CWE's coverage of transient execution weaknesses, which include issues related to Spectre, Meltdown, and other attacks that create or exploit covert channels. As a result of that work, this entry might change in CWE 4.10.::
CWE-386: Symbolic Name not Mapping to Correct Object (Base)

Description: A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design::PHASE:Implementation::



Common Consequences: ::SCOPE:Access Control:IMPACT:Gain Privileges or Assume Identity:NOTE:The attacker can gain access to otherwise unauthorized resources.::SCOPE:Integrity:SCOPE:Confidentiality:SCOPE:Other:IMPACT:Modify Application Data:IMPACT:Modify Files or Directories:IMPACT:Read Application Data:IMPACT:Read Files or Directories:IMPACT:Other:NOTE:Race conditions such as this kind may be employed to gain read or write access to resources not normally readable or writable by the user in question.::SCOPE:Integrity:SCOPE:Other:IMPACT:Modify Application Data:IMPACT:Other:NOTE:The resource in question, or other resources (through the corrupted one) may be changed in undesirable ways by a malicious user.::SCOPE:Non-Repudiation:IMPACT:Hide Activities:NOTE:If a file or other resource is written in this method, as opposed to a valid way, logging of the activity may not occur.::SCOPE:Non-Repudiation:SCOPE:Integrity:IMPACT:Modify Files or Directories:NOTE:In some cases it may be possible to delete files that a malicious user might not otherwise have access to -- such as log files.::
CWE-390: Detection of Error Condition Without Action (Base)

Description: The product detects a specific error, but takes no actions to handle the error.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Varies by Context:IMPACT:Unexpected State:IMPACT:Alter Execution Logic:NOTE:An attacker could utilize an ignored error condition to place the system in an unexpected state that could lead to the execution of unintended logic and could cause other unintended behavior.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Properly handle each exception. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.::PHASE:Implementation:DESCRIPTION:If a function returns an error, it is important to either fix the problem and try again, alert the user that an error has happened and let the program continue, or alert the user and close and cleanup the program.::PHASE:Testing:DESCRIPTION:Subject the product to extensive testing to discover some of the possible instances of where/how errors or return values are not handled. Consider testing techniques such as ad hoc, equivalence partitioning, robustness and fault tolerance, mutation, and fuzzing.::

Observed Examples: ::REFERENCE:CVE-2022-21820:DESCRIPTION:A GPU data center manager detects an error due to a malformed request but does not act on it, leading to memory corruption.:LINK:https://www.cve.org/CVERecord?id=CVE-2022-21820::
CWE-391: Unchecked Error Condition (Base)

Description: [PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Varies by Context:IMPACT:Unexpected State:IMPACT:Alter Execution Logic::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Requirements:DESCRIPTION:The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem.::PHASE:Requirements:DESCRIPTION:A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added.::PHASE:Implementation:DESCRIPTION:Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.::




Notes: ::TYPE:Maintenance:NOTE:This entry is slated for deprecation; it has multiple widespread interpretations by CWE analysts. It currently combines information from three different taxonomies, but each taxonomy is talking about a slightly different issue. CWE analysts might map to this entry based on any of these issues. 7PK has Empty Catch Block which has an association with empty exception block (CWE-1069); in this case, the exception has performed the check, but does not handle. In PLOVER there is Unchecked Return Value which is CWE-252, but unlike Empty Catch Block there isn't even a check of the issue - and Unchecked Error Condition implies lack of a check. For CLASP, Uncaught Exception (CWE-248) is associated with incorrect error propagation - uncovered in CWE 3.2 and earlier, at least. There are other issues related to error handling and checks.::TYPE:Other:NOTE:When a programmer ignores an exception, they implicitly state that they are operating under one of two assumptions: This method call can never fail. It doesn't matter if this call fails.::
CWE-392: Missing Report of Error Condition (Base)

Description: The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Varies by Context:IMPACT:Unexpected State:NOTE:Errors that are not properly reported could place the system in an unexpected state that could lead to unintended behaviors.::



Observed Examples: ::REFERENCE:[REF-1374]:DESCRIPTION:Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generation of non-unique cryptographic keys for Bitcoin wallets (CWE-1391):LINK:https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards::REFERENCE:CVE-2004-0063:DESCRIPTION:Function returns OK even if another function returns a different status code than expected, leading to accepting an invalid PIN number.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-0063::REFERENCE:CVE-2002-1446:DESCRIPTION:Error checking routine in PKCS#11 library returns OK status even when invalid signature is detected, allowing spoofed messages.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1446::REFERENCE:CVE-2002-0499:DESCRIPTION:Kernel function truncates long pathnames without generating an error, leading to operation on wrong directory.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0499::REFERENCE:CVE-2005-2459:DESCRIPTION:Function returns non-error value when a particular erroneous condition is encountered, leading to resultant NULL dereference.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2459::
CWE-393: Return of Wrong Status Code (Base)

Description: A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result.

Extended Description: This can lead to unpredictable behavior. If the function is used to make security-critical decisions or provide security-critical information, then the wrong status code can cause the product to assume that an action is safe, even when it is not.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Unexpected State:IMPACT:Alter Execution Logic:NOTE:This weakness could place the system in a state that could lead unexpected logic to be executed or other unintended behaviors.::

Detection Methods: ::METHOD:Fuzzing:DESCRIPTION:Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.:EFFECTIVENESS:High::


Observed Examples: ::REFERENCE:CVE-2003-1132:DESCRIPTION:DNS server returns wrong response code for non-existent AAAA record, which effectively says that the domain is inaccessible.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-1132::REFERENCE:CVE-2001-1509:DESCRIPTION:Hardware-specific implementation of system call causes incorrect results from geteuid.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-1509::REFERENCE:CVE-2001-1559:DESCRIPTION:Chain: System call returns wrong value (CWE-393), leading to a resultant NULL dereference (CWE-476).:LINK:https://www.cve.org/CVERecord?id=CVE-2001-1559::REFERENCE:CVE-2014-1266:DESCRIPTION:chain: incorrect goto in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple goto fail bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).:LINK:https://www.cve.org/CVERecord?id=CVE-2014-1266::



Notes: ::TYPE:Relationship:NOTE:This can be primary or resultant, but it is probably most often primary to other issues.::
CWE-394: Unexpected Status Code or Return Value (Base)

Description: The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:SCOPE:Other:IMPACT:Unexpected State:IMPACT:Alter Execution Logic::



Observed Examples: ::REFERENCE:CVE-2004-1395:DESCRIPTION:Certain packets (zero byte and other lengths) cause a recvfrom call to produce an unexpected return code that causes a server's listening loop to exit.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-1395::REFERENCE:CVE-2002-2124:DESCRIPTION:Unchecked return code from recv() leads to infinite loop.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-2124::REFERENCE:CVE-2005-2553:DESCRIPTION:Kernel function does not properly handle when a null is returned by a function call, causing it to call another function that it shouldn't.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-2553::REFERENCE:CVE-2005-1858:DESCRIPTION:Memory not properly cleared when read() function call returns fewer bytes than expected.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1858::REFERENCE:CVE-2000-0536:DESCRIPTION:Bypass access restrictions when connecting from IP whose DNS reverse lookup does not return a hostname.:LINK:https://www.cve.org/CVERecord?id=CVE-2000-0536::REFERENCE:CVE-2001-0910:DESCRIPTION:Bypass access restrictions when connecting from IP whose DNS reverse lookup does not return a hostname.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0910::REFERENCE:CVE-2004-2371:DESCRIPTION:Game server doesn't check return values for functions that handle text strings and associated size values.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-2371::REFERENCE:CVE-2005-1267:DESCRIPTION:Resultant infinite loop when function call returns -1 value.:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1267::



Notes: ::TYPE:Relationship:NOTE:Usually primary, but can be resultant from issues such as behavioral change or API abuse. This can produce resultant vulnerabilities.::