CWE-1335 Base Draft

Incorrect Bitwise Shift of Integer

This vulnerability occurs when a program attempts to shift an integer's bits by an invalid amount—either a negative number or a value equal to or greater than the integer's bit width (e.g., shifting…

Definition

What is CWE-1335?

This vulnerability occurs when a program attempts to shift an integer's bits by an invalid amount—either a negative number or a value equal to or greater than the integer's bit width (e.g., shifting a 32-bit integer by 32 or more places). This leads to unpredictable and platform-dependent results.
Shifting bits by a negative count is considered undefined behavior in languages like C and C++. Compilers and interpreters typically don't validate this at runtime, leaving the actual operation to be handled by the underlying hardware. Different CPU architectures may produce varying results—such as shifting in the opposite direction, yielding zero, or even causing a crash—which breaks code portability and introduces subtle bugs. Similarly, an overshift (shifting beyond the bit width) also produces undefined or implementation-defined results. Some languages or compilers might mask the shift count, wrap the value, or return zero, but you cannot rely on consistent behavior. This ambiguity makes the code's outcome architecture- and compiler-dependent, creating security risks when the shifted value is used for calculations, memory offsets, or access controls.
Auswirkungen in der Praxis

Real-world CVEs caused by CWE-1335

  • CVE-2009-4307

    An unexpected large value in the ext4 filesystem causes an overshift condition resulting in a divide by zero.

  • CVE-2012-2100

    An unexpected large value in the ext4 filesystem causes an overshift condition resulting in a divide by zero - fix of CVE-2009-4307.

  • CVE-2020-8835

    An overshift in a kernel allowed out of bounds reads and writes resulting in a root takeover.

  • CVE-2015-1607

    Program is not properly handling signed bitwise left-shifts causing an overlapping memcpy memory range error.

  • CVE-2016-9842

    Compression function improperly executes a signed left shift of a negative integer.

  • CVE-2018-18445

    Some kernels improperly handle right shifts of 32 bit numbers in a 64 bit register.

  • CVE-2013-4206

    Putty has an incorrectly sized shift value resulting in an overshift.

  • CVE-2018-20788

    LED driver overshifts under certain conditions resulting in a DoS.

Wie Angreifer es ausnutzen

Angreiferpfad Schritt für Schritt

  1. 1

    A negative shift amount for an x86 or x86_64 shift instruction will produce the number of bits to be shifted by taking a 2's-complement of the shift amount and effectively masking that amount to the lowest 6 bits for a 64 bit shift instruction.

  2. 2

    The example above ends up with a shift amount of -5. The hexadecimal value is FFFFFFFFFFFFFFFD which, when bits above the 6th bit are masked off, the shift amount becomes a binary shift value of 111101 which is 61 decimal. A shift of 61 produces a very different result than -5. The previous example is a very simple version of the following code which is probably more realistic of what happens in a real system.

  3. 3

    Note that the good example not only checks for negative shifts and disallows them, but it also checks for over-shifts. No bit operation is done if the shift is out of bounds. Depending on the program, perhaps an error message should be logged.

Verwundbares Codebeispiel

Vulnerable C

A negative shift amount for an x86 or x86_64 shift instruction will produce the number of bits to be shifted by taking a 2's-complement of the shift amount and effectively masking that amount to the lowest 6 bits for a 64 bit shift instruction.

Verwundbar C 
unsigned int r = 1 << -5;
Sicheres Codebeispiel

Secure C

Sicher C 
int choose_bit(int reg_bit, int bit_number_from_elsewhere) 
 {

```
   if (NEED_TO_SHIFT)
   {
  	 reg_bit -= bit_number_from_elsewhere;
   }
   return reg_bit;
 }
 unsigned int handle_io_register(unsigned int *r)
 {
   int the_bit_number = choose_bit(5, 10);
   if ((the_bit_number > 0) && (the_bit_number < 63))
   {
  	 unsigned int the_bit = 1 << the_bit_number;
  	 *r |= the_bit;
   }
   return the_bit;
 }
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Präventions-Checkliste

How to prevent CWE-1335

  • Implementation Implicitly or explicitly add checks and mitigation for negative or over-shift values.
Erkennungssignale

How to detect CWE-1335

SAST High

Führe statische Analyse (SAST) auf der Codebasis aus und suche im Datenfluss nach dem unsicheren Muster.

DAST Moderate

Führe dynamische Application-Security-Tests gegen den Live-Endpoint aus.

Runtime Moderate

Beobachte Runtime-Logs auf ungewöhnliche Exception-Traces, fehlerhafte Eingaben oder Versuche, Autorisierung zu umgehen.

Code review Moderate

Code Review: Markiere jeden neuen Code, der Eingaben von dieser Oberfläche ohne validierte Framework-Helper verarbeitet.

Plexicus Auto-Fix

Plexicus erkennt CWE-1335 automatisch und öffnet in unter 60 Sekunden einen Fix-PR.

Codex Remedium scannt jeden Commit, identifiziert genau diese Schwachstelle und liefert einen reviewer-ready Pull Request mit dem Patch. Keine Tickets. Keine Hand-offs.

Demo anfordern Plexicus kostenlos testen
Häufig gestellte Fragen

Frequently asked questions

Was ist CWE-1335?

This vulnerability occurs when a program attempts to shift an integer's bits by an invalid amount—either a negative number or a value equal to or greater than the integer's bit width (e.g., shifting a 32-bit integer by 32 or more places). This leads to unpredictable and platform-dependent results.

Wie gravierend ist CWE-1335?

MITRE hat für diese Schwachstelle keine Exploit-Wahrscheinlichkeit veröffentlicht. Behandle sie als mittlere Auswirkung, bis dein Threat Model anderes belegt.

Welche Sprachen oder Plattformen sind von CWE-1335 betroffen?

MITRE lists the following affected platforms: C, C++, C#, Java, JavaScript, Not OS-Specific, Not Technology-Specific.

Wie kann ich CWE-1335 verhindern?

Implicitly or explicitly add checks and mitigation for negative or over-shift values.

Wie erkennt und behebt Plexicus CWE-1335?

Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-1335 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.

Wo erfahre ich mehr über CWE-1335?

MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/1335.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.

Verwandte Schwachstellen

Weaknesses related to CWE-1335

CWE-682 Parent

Incorrect Calculation

This vulnerability occurs when software performs a calculation that produces wrong or unexpected results, which are then used to make…

CWE-128 Sibling

Wrap-around Error

A wrap-around error happens when a variable exceeds the maximum value its data type can hold, causing it to unexpectedly reset to a very…

CWE-131 Sibling

Incorrect Calculation of Buffer Size

This vulnerability occurs when a program miscalculates the amount of memory needed for a buffer, potentially leading to a buffer overflow…

CWE-1339 Sibling

Insufficient Precision or Accuracy of a Real Number

This vulnerability occurs when a program uses a data type or algorithm that cannot accurately represent or calculate the fractional part…

CWE-135 Sibling

Incorrect Calculation of Multi-Byte String Length

This vulnerability occurs when software incorrectly measures the length of strings containing multi-byte or wide characters, leading to…

CWE-190 Sibling

Integer Overflow or Wraparound

Integer overflow or wraparound occurs when a calculation produces a numeric result that exceeds the maximum value a variable can hold.…

CWE-191 Sibling

Integer Underflow (Wrap or Wraparound)

Integer underflow occurs when a subtraction operation results in a value smaller than the data type's minimum limit, causing the value to…

CWE-193 Sibling

Off-by-one Error

An off-by-one error occurs when a program incorrectly calculates a boundary, such as a loop counter or array index, by being one unit too…

CWE-369 Sibling

Divide By Zero

A divide-by-zero error occurs when software attempts to perform a division operation where the denominator is zero.

Ressourcen

Further reading

Bereit, wenn du es bist

Schluss mit dem Bezahlen pro Entwickler.
Schließ den Kreislauf.

Plexicus ist die KI-native ASPM, die scannt, filtert, fixt, pentestet und erklärt — autonom. Unbegrenzte Entwickler, unbegrenzte Repos, Fair-Use-KI-Aktionen. Echter kostenloser Tarif, €269/mo jährlich, wenn du bereit bist.

Kostenlos starten Demo buchen