What is Incorrect Calculation (CWE-682)?

TL;DR: Incorrect Calculation (CWE-682) is a vulnerability where software performs incorrect or unintended calculations, leading to security issues. Proper input validation and safe integer handling can mitigate these risks.

What is Incorrect Calculation?

Incorrect Calculation (CWE-682) is a type of vulnerability where software performs arithmetic operations that generate incorrect or unintended results. As defined by the MITRE Corporation under CWE-682, and classified by the OWASP Foundation as not directly mapped…

Quick Summary

Incorrect Calculation occurs when software performs calculations that produce unexpected or incorrect results due to integer overflow, underflow, or other numeric errors. This can lead to security vulnerabilities such as crashes, resource consumption issues, and unauthorized code execution.

Jump to: Quick Summary · Incorrect Calculation Overview · How Incorrect Calculation Works · Business Impact of Incorrect Calculation · Incorrect Calculation Attack Scenario · How to Detect Incorrect Calculation · How to Fix Incorrect Calculation · Framework-Specific Fixes for Incorrect Calculation · How to Ask AI to Check Your Code for Incorrect Calculation · Incorrect Calculation Best Practices Checklist · Incorrect Calculation FAQ · Vulnerabilities Related to Incorrect Calculation · References · Scan Your Own Site

Incorrect Calculation Overview

What

Incorrect Calculation (CWE-682) occurs when software performs arithmetic operations that yield incorrect or unintended results, often due to integer overflow or underflow.

Why it matters

These errors can lead to security issues such as crashes, resource consumption problems, and unauthorized code execution. Understanding the underlying representation of numeric types is crucial for preventing these vulnerabilities.

Where it occurs

Incorrect Calculation commonly affects applications that perform arithmetic operations with large numbers or handle user-provided numeric inputs without proper validation.

Who is affected

Developers and security professionals working on software systems that involve complex numerical calculations are at risk of Incorrect Calculation vulnerabilities.

Who is NOT affected

Systems already using safe integer handling libraries or frameworks that automatically manage numeric types and prevent overflow conditions are generally not affected by this vulnerability.

How Incorrect Calculation Works

Root Cause

The root cause of Incorrect Calculation is the incorrect handling of arithmetic operations, leading to unexpected results such as integer overflow or underflow.

Attack Flow

1. An attacker inputs a large number that exceeds the numeric type’s maximum value.
2. The application performs an operation on this number, causing it to wrap around and produce an unintended result.
3. This incorrect result is used in security-critical decisions or resource management, leading to vulnerabilities such as crashes or unauthorized access.

Prerequisites to Exploit

• An arithmetic operation that can overflow the numeric type’s limits.
• User-provided input influencing the values involved in the calculation.

Vulnerable Code

def calculate_sum(a, b):
    return a + b

result = calculate_sum(2**31 - 1, 1)

This code demonstrates an integer overflow vulnerability where adding two large numbers causes the result to wrap around and become negative.

Secure Code

import sys

def calculate_sum(a, b):
    if (a > 0 and b > sys.maxsize - a) or (a < 0 and b < sys.minint - a):
        raise ValueError("Integer overflow detected")
    return a + b

result = calculate_sum(2**31 - 1, 1)

This secure code checks for potential integer overflow before performing the addition operation.

Business Impact of Incorrect Calculation

Availability

• Crashes: The application may crash due to unexpected arithmetic results.

• Resource Consumption: Integer overflow can lead to resource consumption issues like memory leaks or CPU exhaustion.

  • Financial: Downtime and lost revenue from service disruptions.
  • Compliance: Non-compliance with security standards and regulations.
  • Reputation: Loss of customer trust and potential legal liabilities.

Integrity

• Data Corruption: Incorrect calculations may corrupt data stored in databases or files.

  • Data loss and integrity issues leading to financial penalties and reputational damage.

Incorrect Calculation Attack Scenario

1. An attacker inputs a large number that exceeds the numeric type’s maximum value into an application.
2. The application performs arithmetic operations on this number, causing it to wrap around due to integer overflow.
3. This incorrect result is used in security-critical decisions or resource management, leading to vulnerabilities such as crashes or unauthorized access.

How to Detect Incorrect Calculation

Manual Testing

• Review code for potential arithmetic operations that could lead to integer overflow or underflow.
• Check if numeric values are validated before performing calculations.

Automated Scanners (SAST / DAST)

Static analysis can detect potential arithmetic operations leading to integer overflow, while dynamic testing can identify actual runtime issues.

PenScan Detection

PenScan’s automated scanners such as ZAP and Wapiti can identify incorrect calculation vulnerabilities by analyzing code for unsafe numeric operations.

False Positive Guidance

A false positive may occur if the scanner detects a pattern that looks risky but is actually safe due to context not visible in static analysis.

How to Fix Incorrect Calculation

• Understand your programming language’s underlying representation of numeric types and how they interact with calculations.
• Perform input validation on any numeric inputs to ensure they are within expected ranges.
• Use appropriate data types for the desired action, such as unsigned integers for values that cannot be negative.
• Employ safe integer handling libraries or frameworks to manage numeric operations safely.

Framework-Specific Fixes for Incorrect Calculation

Python/Django

import sys

def calculate_sum(a, b):
    if (a > 0 and b > sys.maxsize - a) or (a < 0 and b < sys.minint - a):
        raise ValueError("Integer overflow detected")
    return a + b

result = calculate_sum(2**31 - 1, 1)

Java

public long calculateSum(long a, long b) {
    if (a > 0 && b > Long.MAX_VALUE - a || a < 0 && b < Long.MIN_VALUE - a) {
        throw new ArithmeticException("Integer overflow detected");
    }
    return a + b;
}

long result = calculateSum(Long.MAX_VALUE, 1);

How to Ask AI to Check Your Code for Incorrect Calculation

Incorrect Calculation Best Practices Checklist

✅ Understand your programming language’s numeric type representation. ✅ Perform input validation on any numeric inputs. ✅ Use appropriate data types for desired actions. ✅ Employ safe integer handling libraries or frameworks. ✅ Check compiler warnings closely and eliminate potential security issues.

Incorrect Calculation FAQ

How does incorrect calculation occur in software?

Incorrect calculation happens when a program performs arithmetic operations that yield unexpected results, often due to integer overflow or underflow.

Why is input validation important for preventing incorrect calculation?

Input validation ensures numeric inputs are within expected ranges, preventing calculations from producing invalid or dangerous results.

How does an incorrect calculation affect system availability?

Incorrect calculation can lead to resource consumption issues like integer overflow, causing the application to crash and become unavailable.

What is a common example of incorrect calculation in real-world applications?

A common example involves arithmetic operations that exceed numeric limits, such as adding large numbers leading to an unexpected wrap-around value.

How can developers detect incorrect calculation vulnerabilities manually?

Developers should review code for potential overflow conditions and ensure proper handling of numeric values across different data types.

What are the best practices for fixing incorrect calculation issues in Python applications?

Use libraries like SafeInt or IntegerLib to handle integer operations safely, ensuring calculations do not exceed expected ranges.

How can I prevent incorrect calculation vulnerabilities when working with C++ code?

Employ safe integer handling packages such as SafeInt to manage numeric values and avoid overflow conditions.

Vulnerabilities Related to Incorrect Calculation

| CWE | Name | Relationship | |—|—|—| | CWE-170 | Improper Null Termination (CanPrecede) |

References

• MITRE: CWE-682
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Incorrect Calculation and other risks before an attacker does.