Skip to content

[CPP]: Add query for CWE-754: Improper Check for Unusual or Exceptional Conditions when using functions scanf #553

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
1 of 2 tasks
ihsinme opened this issue Mar 14, 2022 · 8 comments
Closed
1 of 2 tasks

[CPP]: Add query for CWE-754: Improper Check for Unusual or Exceptional Conditions when using functions scanf #553

ihsinme opened this issue Mar 14, 2022 · 8 comments
Labels
All For One Submissions to the All for One, One for All bounty

Comments

@ihsinme
Copy link

ihsinme commented Mar 14, 2022

Query PR

github/codeql#8246

Language

C/C++

CVE(s) ID list

CVE-2019-15900

CWE

CWE-754: Improper Check for Unusual or Exceptional Conditions

Report

  1. in undefined behavior with uninitiated arguments and no function validation.
  2. uninitialized variables will be filled with random values. in case of an error in the function that fills these variables, the developer will continue to work with random values.
  3. look for places without checking the results of the function, provided that the arguments were not previously initialized.
  4. Eliminate situations when there is a comparison of the values of the arguments after the call.

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

  • Yes
  • No

Blog post link

https://twitter.com/ihsinme/status/1503261203262550017
@ihsinme ihsinme added the All For One Submissions to the All for One, One for All bounty label Mar 14, 2022
@agustingianni
Copy link
Contributor

Hello @ihsinme thanks for your submission. We are processing it.

@ghsecuritylab
Copy link
Collaborator

Your submission is now in status Test run.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

@ghsecuritylab
Copy link
Collaborator

Your submission is now in status Results analysis.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

@ghsecuritylab
Copy link
Collaborator

Your submission is now in status Final decision.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

@ghsecuritylab
Copy link
Collaborator

Your submission is now in status Pay.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

@xcorail
Copy link
Contributor

xcorail commented Apr 23, 2022

Created Hackerone report 1549073 for bounty 385625 : [553] [CPP]: Add query for CWE-754: Improper Check for Unusual or Exceptional Conditions when using functions scanf

@xcorail xcorail closed this as completed Apr 23, 2022
@ghsecuritylab
Copy link
Collaborator

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

@ihsinme
Copy link
Author

ihsinme commented Apr 23, 2022

thanks @agustingianni and @xcorail

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
All For One Submissions to the All for One, One for All bounty
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@agustingianni @xcorail @ihsinme @ghsecuritylab