Unvalidated Function Hook Arguments
Weakness ID: 622 (Weakness Variant)Status: Draft
+ Description

Description Summary

A product adds hooks to user-accessible API functions, but does not properly validate the arguments. This could lead to resultant vulnerabilities.

Extended Description

Such hooks can be used in defensive software that runs with privileges, such as anti-virus or firewall, which hooks kernel calls. When the arguments are not validated, they could be used to bypass the protection scheme or attack the product itself.

+ Time of Introduction
  • Implementation
+ Applicable Platforms

Languages

All

+ Observed Examples
ReferenceDescription
CVE-2007-0708DoS in firewall using standard Microsoft functions
CVE-2006-7160DoS in firewall using standard Microsoft functions
CVE-2007-1376function does not verify that its argument is the proper type, leading to arbitrary memory write
CVE-2007-1220invalid syscall arguments bypass code execution limits
CVE-2006-4541DoS in IDS via NULL argument
+ Potential Mitigations

Ensure that all arguments are verified, as defined by the API you are protecting.

Drop privileges before invoking such functions, if possible.

+ Weakness Ordinalities
OrdinalityDescription
Primary
(where the weakness exists independent of other weaknesses)
+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness Class20Improper Input Validation
Development Concepts (primary)699
ChildOfWeakness BaseWeakness Base88Argument Injection or Modification
Research Concepts (primary)1000
+ Content History
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Description, Relationships, Observed Example, Other Notes
2009-12-28CWE Content TeamMITREInternal
updated Other Notes, Weakness Ordinalities
Back to top