What is Integer Overflow or Wraparound (CWE-190)?

TL;DR: Integer Overflow or Wraparound (CWE-190) is a vulnerability where calculations exceed the maximum value of an integer, leading to unexpected behavior. Proper input validation and use of safe integer handling libraries can prevent these issues.

What is Integer Overflow or Wraparound?

Integer Overflow or Wraparound (CWE-190) is a type of numeric calculation error vulnerability where an integer value exceeds its maximum capacity, leading to unexpected behavior. As defined by the MITRE Corporation under CWE-190, and classified by the OWASP Foundation as not directly mapped.

Quick Summary

Integer Overflow or Wraparound occurs when calculations exceed the maximum value that can be stored in an integer variable, causing it to wrap around and become very small or negative. This can lead to crashes, data corruption, and security issues such as buffer overflows and unauthorized code execution. Jump to: [Overview] · [How It Works] · [Business Impact] · [Attack Scenario] · [Detection] · [Fixing] · [Framework Fixes] · [Ask AI] · [Best Practices] · [FAQ] · [Related Vulnerabilities]

Jump to: Quick Summary · Integer Overflow or Wraparound Overview · How Integer Overflow or Wraparound Works · Business Impact of Integer Overflow or Wraparound · Integer Overflow or Wraparound Attack Scenario · How to Detect Integer Overflow or Wraparound · How to Fix Integer Overflow or Wraparound · Framework-Specific Fixes for Integer Overflow or Wraparound · How to Ask AI to Check Your Code for Integer Overflow or Wraparound · Integer Overflow or Wraparound Best Practices Checklist · Integer Overflow or Wraparound FAQ · Vulnerabilities Related to Integer Overflow or Wraparound · References · Scan Your Own Site

Integer Overflow or Wraparound Overview

What: Integer Overflow or Wraparound is a numeric calculation error where an integer value exceeds its maximum capacity, leading to unexpected behavior.

Why it matters: This can cause crashes, data corruption, and security issues such as buffer overflows and unauthorized code execution.

Where it occurs: Any language that performs numerical calculations.

Who is affected: Developers working with languages that do not automatically handle numeric overflow.

Who is NOT affected: Systems already using safe integer handling libraries or strict input validation mechanisms.

How Integer Overflow or Wraparound Works

Root Cause

Integer overflows occur when a calculation produces a value larger than the maximum representable by an integer type, causing it to wrap around and become very small or negative.

Attack Flow

1. An attacker inputs a large number that causes an overflow.
2. The program performs calculations with this invalid value.
3. Unexpected behavior occurs due to the incorrect result.

Prerequisites to Exploit

• A calculation involving integer values.
• Lack of input validation for numeric ranges.

Vulnerable Code

def calculate_sum(a, b):
    return a + b

This code is vulnerable because it performs arithmetic operations without checking if the result exceeds the maximum value that can be stored in an integer variable.

Secure Code

import safeint

def calculate_sum(a, b):
    try:
        return safeint.add(a, b)
    except OverflowError:
        raise ValueError("Integer overflow occurred")

This code uses a safe integer handling library to perform the addition and raises an error if an overflow occurs.

Business Impact of Integer Overflow or Wraparound

Confidentiality: None known. Integrity: Data corruption can occur due to incorrect calculations, leading to modified memory contents. Availability: Crashes and resource consumption (memory/CPU) can lead to denial-of-service conditions.

• Financial loss from system downtime.
• Compliance issues with data integrity regulations.
• Damage to reputation if sensitive information is compromised.

Integer Overflow or Wraparound Attack Scenario

1. An attacker inputs a large number into a calculation function.
2. The program performs the addition and overflows due to the large input.
3. Unexpected behavior occurs, leading to system instability or crashes.

How to Detect Integer Overflow or Wraparound

Manual Testing

• Check for calculations involving integer values without proper validation.
• Ensure numeric ranges are validated before performing arithmetic operations.
• Test with extreme values to verify overflow handling.

Automated Scanners (SAST / DAST)

Static analysis can identify potential overflows by detecting unchecked arithmetic operations. Dynamic testing is needed to confirm actual vulnerabilities in runtime scenarios.

PenScan Detection

PenScan’s automated scanners actively detect integer overflow vulnerabilities using ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap.

False Positive Guidance

A real finding will show a calculation that can exceed the maximum value without proper handling. A false positive may occur if the code correctly handles potential overflows or uses safe integer operations.

How to Fix Integer Overflow or Wraparound

• Use vetted libraries for safe integer handling.
• Perform input validation on numeric inputs.
• Understand the underlying representation of numbers in your programming language.
• Ensure strict conformance to protocols that define out-of-bounds behavior.
• Choose languages with automatic bounds checking if possible.

Framework-Specific Fixes for Integer Overflow or Wraparound

def calculate_sum(a, b):
    import safeint
    try:
        return safeint.add(a, b)
    except OverflowError:
        raise ValueError("Integer overflow occurred")

This Python code uses the safeint library to safely perform addition and raises an error if an overflow occurs.

How to Ask AI to Check Your Code for Integer Overflow or Wraparound

Integer Overflow or Wraparound Best Practices Checklist

• ✅ Use vetted libraries for safe integer handling.
• ✅ Perform input validation on numeric inputs to ensure they are within expected ranges.
• ✅ Understand the underlying representation of numbers in your programming language.
• ✅ Choose languages with automatic bounds checking if possible.

Integer Overflow or Wraparound FAQ

How does an integer overflow occur?

An integer overflow happens when a calculation exceeds the maximum value that can be stored in an integer variable, causing it to wrap around and become very small or negative.

What are the consequences of an integer overflow?

Integer overflows can lead to crashes, resource consumption, instability, data corruption, unauthorized code execution, and incorrect security decisions.

How do you prevent integer overflows in C++?

Use libraries like SafeInt or IntegerLib that provide safe integer handling functions, perform input validation on numeric inputs, and understand the underlying representation of numbers in your programming language.

How can you detect an integer overflow vulnerability manually?

Review code for calculations that may exceed the maximum value of integer variables, check input validation practices, and ensure proper handling of numeric values across different platforms.

What are some real-world examples of integer overflows leading to security issues?

Integer overflows can cause buffer overflows, memory corruption, and incorrect resource allocation, potentially leading to denial-of-service conditions or unauthorized code execution.

How does an automated scanner detect integer overflow vulnerabilities?

Automated scanners analyze source code for patterns indicative of potential integer overflow risks, such as unchecked arithmetic operations and boundary conditions.

Vulnerabilities Related to Integer Overflow or Wraparound

References

• MITRE - CWE-190
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Integer Overflow or Wraparound and other risks before an attacker does.