CWE-695: Use of Low-Level Functionality

What is Use of Low-Level Functionality?

• Overview: This vulnerability occurs when a product uses low-level functionality that is explicitly prohibited by the framework or specification it is supposed to operate under. This can lead to unexpected violations of the specification, disabling protection mechanisms, creating inconsistencies, or exposing functionality to attack.

• Exploitation Methods:

• Attackers can exploit this vulnerability by identifying and targeting the low-level operations that bypass the intended framework protections.
• Common attack patterns include manipulating low-level system calls or API functions that operate outside the designed security constraints.

• Security Impact:

• Direct consequences include the bypassing of built-in security features and introducing vulnerabilities that can be directly exploited.
• Potential cascading effects involve creating inconsistencies within the application logic or data processing, potentially leading to broader security breaches.
• Business impact can include data breaches, loss of customer trust, regulatory fines, and damage to the company's reputation.

• Prevention Guidelines:

• Specific code-level fixes involve adhering strictly to the framework's guidelines and avoiding the use of prohibited low-level functions.
• Security best practices include regular code reviews and static analysis to ensure compliance with the framework specifications.
• Recommended tools and frameworks include those that enforce high-level abstraction layers and provide security checks against low-level function usage.

Corgea can automatically detect and fix Use of Low-Level Functionality in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not specified

Affected Technologies: Not specified