1 vulnerabilities classified as CWE-588 (尝试访问一个非结构体指针的子域). AI Chinese analysis included.
CWE-588 represents a critical memory safety vulnerability where a program incorrectly casts a non-structure pointer to a structure type and subsequently accesses its fields. This weakness typically arises from flawed type assumptions or improper memory management, leading developers to treat arbitrary memory locations as structured data objects. Attackers exploit this by manipulating input to trigger invalid memory accesses, potentially causing segmentation faults, data corruption, or arbitrary code execution if the misaligned access reveals sensitive information or overwrites adjacent memory. To prevent this, developers must enforce strict type checking and validate pointer types before dereferencing them. Utilizing static analysis tools to detect unsafe casts and employing language features that enforce type safety can significantly reduce the risk. Additionally, thorough code reviews focusing on pointer arithmetic and memory layout assumptions help ensure that structure accesses remain within valid bounds, thereby maintaining application integrity and security.
struct foo { int i; } ... int main(int argc, char **argv) { *foo = (struct foo *)main; foo->i = 2; return foo->i; }| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2021-3510 | Zephyr JSON decoder incorrectly decodes array of array — zephyr | 7.5 | High | 2021-10-05 |
Vulnerabilities classified as CWE-588 (尝试访问一个非结构体指针的子域) represent 1 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.