What is Numeric Truncation Error (CWE-197)?

TL;DR: Numeric Truncation Error (CWE-197) is a vulnerability that occurs when data is lost due to truncation errors. It can be prevented by ensuring that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.

At-a-Glance

What is Numeric Truncation Error?

Numeric Truncation Error (CWE-197) is a type of vulnerability that occurs when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. As defined by the MITRE Corporation under CWE-197, this vulnerability can be classified as a truncation error.

Quick Summary

Numeric Truncation Error (CWE-197) is a type of vulnerability that occurs when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. This can lead to security vulnerabilities and data corruption. It can be prevented by ensuring that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.

Jump to: Quick Summary · Numeric Truncation Error Overview · How Numeric Truncation Error Works · Business Impact of Numeric Truncation Error · Numeric Truncation Error Attack Scenario · How to Detect Numeric Truncation Error · How to Fix Numeric Truncation Error · Framework-Specific Fixes for Numeric Truncation Error · How to Ask AI to Check Your Code for Numeric Truncation Error · Numeric Truncation Error Best Practices Checklist · Numeric Truncation Error FAQ · Vulnerabilities Related to Numeric Truncation Error · References · Scan Your Own Site

Numeric Truncation Error Overview

What

Numeric Truncation Error (CWE-197) is a type of vulnerability that occurs when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

Why it matters

The true value of the data is lost, and corrupted data is used. This can lead to security vulnerabilities and data corruption.

Where it occurs

This vulnerability can occur in various programming languages, including C, C++, Java, Python, Node.js, and PHP.

Who is affected

Any application that uses primitive types and performs casting operations can be affected by this vulnerability.

Who is NOT affected

Applications that do not use primitive types or perform casting operations are not affected by this vulnerability.

How Numeric Truncation Error Works

Root Cause

The root cause of Numeric Truncation Error (CWE-197) is the loss of data due to truncation errors when a primitive is cast to a primitive of a smaller size.

Attack Flow

1. The attacker attempts to exploit the vulnerability by casting a large value to a smaller type.
2. The application performs the casting operation, resulting in data loss and corruption.
3. The corrupted data is used, leading to security vulnerabilities and data corruption.

Prerequisites to Exploit

• The application must use primitive types and perform casting operations.
• The attacker must have access to the application’s code and be able to manipulate the input values.

Vulnerable Code

int x = 1234567890;
short y = (short)x; // Truncation error occurs here

This code demonstrates a truncation error when casting an integer value to a short type. The result is a corrupted value that can lead to security vulnerabilities and data corruption.

Secure Code

int x = 1234567890;
long y = (long)x; // No truncation error occurs here

This code demonstrates the secure way to cast an integer value to a long type. The result is a correctly converted value without any data loss or corruption.

Business Impact of Numeric Truncation Error

Confidentiality

The true value of the data is lost, and corrupted data is used. This can lead to security vulnerabilities and data corruption.

Integrity

The corrupted data is used, leading to security vulnerabilities and data corruption.

Availability

The application may become unavailable due to the corrupted data.

Numeric Truncation Error Attack Scenario

1. The attacker attempts to exploit the vulnerability by casting a large value to a smaller type.
2. The application performs the casting operation, resulting in data loss and corruption.
3. The corrupted data is used, leading to security vulnerabilities and data corruption.

How to Detect Numeric Truncation Error

Manual Testing

• Review the code for any casting operations that may lead to truncation errors.
• Test the code with large input values to detect any potential issues.

Automated Scanners (SAST / DAST)

• Use automated scanners to identify any potential vulnerabilities in the code.
• The scanner can detect any casting operations that may lead to truncation errors.

PenScan Detection

PenScan’s scanner engines actively test for this issue and provide detailed reports on any potential vulnerabilities found.

False Positive Guidance

• Be cautious when reviewing the results of automated scanners, as they may generate false positives due to the complexity of the code.
• Use manual testing to verify the results of automated scanners.

How to Fix Numeric Truncation Error

• Ensure that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.
• Review the code for any potential vulnerabilities and make necessary changes to prevent truncation errors.

Framework-Specific Fixes for Numeric Truncation Error

Java

int x = 1234567890;
long y = (long)x; // No truncation error occurs here

This code demonstrates the secure way to cast an integer value to a long type in Java. The result is a correctly converted value without any data loss or corruption.

Node.js

let x = 1234567890;
let y = (x); // No truncation error occurs here

This code demonstrates the secure way to cast an integer value to a number type in Node.js. The result is a correctly converted value without any data loss or corruption.

Python/Django

x = 1234567890
y = x # No truncation error occurs here

This code demonstrates the secure way to assign an integer value to another variable in Python/Django. The result is a correctly assigned value without any data loss or corruption.

How to Ask AI to Check Your Code for Numeric Truncation Error

Review the following [language] code block for potential CWE-197 Numeric Truncation Error vulnerabilities and rewrite it using explicit casting:

int x = 1234567890;
short y = (short)x; // Truncation error occurs here

Rewrite the code to use explicit casting:

int x = 1234567890;
long y = (long)x; // No truncation error occurs here

Numeric Truncation Error Best Practices Checklist

✅ Use explicit casting when necessary. ✅ Review the code for any potential vulnerabilities and make necessary changes to prevent truncation errors.

Numeric Truncation Error FAQ

How does Numeric Truncation Error occur?

A truncation error occurs when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

What are the consequences of Numeric Truncation Error?

The true value of the data is lost, and corrupted data is used.

How can I prevent Numeric Truncation Error?

Ensure that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.

What are the related weaknesses to Numeric Truncation Error?

CWE-681: Incorrect Conversion between Numeric Types, CWE-195: Signed to Unsigned Conversion Error, CWE-196: Unsigned to Signed Conversion Error, CWE-192: Integer Coercion Error, and CWE-194: Unexpected Sign Extension.

What are the potential mitigations for Numeric Truncation Error?

Ensure that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.

How can I detect Numeric Truncation Error in my code?

Use automated scanners (SAST / DAST) and manual testing to identify potential vulnerabilities.

What are the best practices for preventing Numeric Truncation Error?

Ensure that no casts, implicit or explicit, take place that move from a larger size primitive or a smaller size primitive.

Vulnerabilities Related to Numeric Truncation Error

References

• MITRE: CWE-197
• CAPEC: None known
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Numeric Truncation Error and other risks before an attacker does.