Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-843 (使用不兼容类型访问资源(类型混淆)) — Vulnerability Class 348

348 vulnerabilities classified as CWE-843 (使用不兼容类型访问资源(类型混淆)). AI Chinese analysis included.

CWE-843, Type Confusion, is a critical memory safety weakness where a resource is initialized with one data type but subsequently accessed using an incompatible type. This discrepancy often triggers logical errors or undefined behavior, particularly in memory-unsafe languages like C and C++, where the program misinterprets the underlying bit patterns. Attackers typically exploit this vulnerability by crafting malicious inputs that force the application to treat a pointer or object as a different type, potentially leading to arbitrary code execution, data corruption, or denial of service. To mitigate this risk, developers must enforce strict type checking and validation at runtime. Utilizing memory-safe programming languages, implementing comprehensive unit tests for type assertions, and employing static analysis tools can effectively detect these mismatches before deployment, ensuring that resources are always accessed according to their intended definitions.

MITRE CWE Description
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access. While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways. This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.
Common Consequences (1)
Availability, Integrity, ConfidentialityRead Memory, Modify Memory, Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart
When a memory buffer is accessed using the wrong type, it could read or write memory out of the bounds of the buffer, if the allocated buffer is smaller than the type that the code is attempting to access, leading to a crash and possibly code execution.
Examples (2)
The following code uses a union to support the representation of different types of messages. It formats messages differently, depending on their type.
#define NAME_TYPE 1 #define ID_TYPE 2 struct MessageBuffer { int msgType; union { char *name; int nameID; }; }; int main (int argc, char **argv) { struct MessageBuffer buf; char *defaultMessage = "Hello World"; buf.msgType = NAME_TYPE; buf.name = defaultMessage; printf("Pointer of buf.name is %p\n", buf.name); /* This particular value for nameID is used to make the code architecture-independent. If coming from untrusted input, it could be any value. */ buf.nameID = (int)(defaultMessage + 1); printf("Pointer of buf.name is now %p\n", buf.name); if (buf.msgType == NAME_TYPE) { printf("Message: %
Bad · C
The following PHP code accepts a value, adds 5, and prints the sum.
$value = $_GET['value']; $sum = $value + 5; echo "value parameter is '$value'<p>"; echo "SUM is $sum";
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2022-29209 Type confusion leading to `CHECK`-failure based denial of service in TensorFlow — tensorflow 5.5 Medium2022-05-20
CVE-2022-1176 Loose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchat — livehelperchat/livehelperchat 7.5 -2022-03-31
CVE-2021-46152 Siemens Simcenter Femap 安全漏洞 — Simcenter Femap V2020.2 7.8 -2022-02-09
CVE-2021-34866 Linux kernel 安全漏洞 — Kernel 7.0 -2022-01-25
CVE-2021-24044 Facebook Hermes 安全漏洞 — Hermes 9.8 -2022-01-15
CVE-2021-24045 Facebook Hermes 安全漏洞 — Hermes 9.1 -2021-12-13
CVE-2021-41190 Clarify Content-Type handling in OCI spec — distribution-spec 3.0 Low2021-11-17
CVE-2021-31344 Siemens Nucleus ReadyStart 安全漏洞 — Capital Embedded AR Classic 431-422 5.3 Medium2021-11-09
CVE-2021-39841 Adobe Acrobat Pro DC DocMedia Type Confusion Remote Code Execution Vulnerability — Acrobat Reader 7.8 -2021-09-29
CVE-2021-39219 Wrong type for `Linker`-define functions when used across two `Engine`s — wasmtime 6.3 Medium2021-09-17
CVE-2021-35986 Adobe Acrobat Pro DC getAnnot Type Confusion Information Disclosure Vulnerability — Acrobat Reader 3.3 Low2021-08-20
CVE-2021-28643 Adobe Acrobat Pro DC embedDocAsDataObject Type Confusion Information Disclosure Vulnerability — Acrobat Reader 3.3 Low2021-08-20
CVE-2021-31476 Foxit PhantomPDF 安全漏洞 — PhantomPDF 7.8 -2021-06-16
CVE-2021-31480 OpenText Brava! 安全漏洞 — Brava! Desktop 7.8 -2021-06-15
CVE-2021-29519 CHECK-fail in SparseCross due to type confusion — tensorflow 2.5 Low2021-05-14
CVE-2021-31461 Foxit Reader 安全漏洞 — Reader 7.8 -2021-05-07
CVE-2020-27257 Omron CX-One — CX-One 7.8 -2021-02-09
CVE-2020-26990 Siemens Jt2go和Siemens Teamcenter Visualization 安全漏洞 — JT2Go 8.0 -2021-01-12
CVE-2020-26980 Siemens Jt2go 和 Siemens Teamcenter Visualization 授权问题漏洞 — JT2Go 8.8 -2021-01-12
CVE-2020-27293 Delta Electronics CNCSoft-B 安全漏洞 — Delta Electronics 7.8 -2021-01-11
CVE-2020-6656 File parsing Type Confusion Remote code execution vulerability — easySoft Software 5.8 Medium2021-01-07
CVE-2020-13547 Foxit Reader 资源管理错误漏洞 — Foxit 8.8 -2020-12-22
CVE-2020-25661 Linux kernel 安全漏洞 — kernel 7.5 High2020-11-05
CVE-2020-1911 Facebook Hermes 安全漏洞 — Hermes 8.1 -2020-09-04
CVE-2020-15638 Foxit Reader和PhantomPDF 资源管理错误漏洞 — PhantomPDF 7.8 -2020-08-19
CVE-2020-16229 Advantech WebAccess HMI Designer 安全漏洞 — Advantech WebAccess HMI Designer 7.8 -2020-08-06
CVE-2019-17639 Eclipse OpenJ9 安全漏洞 — Eclipse OpenJ9 7.5 -2020-07-15
CVE-2019-15792 Type confusion in shiftfs — Shiftfs in the Linux kernel 7.1 High2020-04-23
CVE-2020-10913 Foxit Reader和PhantomPDF 安全漏洞 — PhantomPDF 7.8 -2020-04-22
CVE-2020-10911 Foxit Reader和PhantomPDF 安全漏洞 — PhantomPDF 7.8 -2020-04-22

Vulnerabilities classified as CWE-843 (使用不兼容类型访问资源(类型混淆)) represent 348 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.