CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

What is Access of Resource Using Incompatible Type ('Type Confusion')?

• Overview: Access of Resource Using Incompatible Type ('Type Confusion') occurs when a program allocates or initializes a resource using one type but later accesses it using an incompatible type, leading to logical errors and potentially unsafe behavior.

• Exploitation Methods:

• Attackers can exploit this vulnerability by manipulating the type of data processed by the application, causing it to interpret data incorrectly.
• Common attack patterns include crafting inputs that trigger type mismatches, especially in memory-unsafe languages like C and C++, leading to memory corruption or unauthorized access.

• Security Impact:

• Direct consequences of successful exploitation include out-of-bounds memory access, crashes, or execution of arbitrary code.
• Potential cascading effects include information leaks, data corruption, and compromised system integrity.
• Business impact can involve data breaches, loss of customer trust, and financial damage due to service downtime or legal implications.

• Prevention Guidelines:

• Specific code-level fixes include strict type checking and ensuring type compatibility when accessing resources.
• Security best practices involve using memory-safe languages when possible, employing type-safe APIs, and validating input data to prevent type mismatches.
• Recommended tools and frameworks include static analysis tools to detect type confusion, runtime checks to enforce type safety, and employing modern C++ features like smart pointers to manage memory safely.

Corgea can automatically detect and fix Access of Resource Using Incompatible Type ('Type Confusion') in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: C, C++

Affected Technologies: Not specified

Vulnerable Code Example

// Vulnerable code demonstrating type confusion
#include <stdio.h>
#include <stdlib.h>

// Function that mistakenly uses a void pointer for arithmetic operations
void process_data(void *data) {
    // Assume data is an integer type, perform arithmetic operation
    // This causes type confusion if data is not an integer
    int *int_data = (int *)data;
    *int_data += 10;  
    printf("Processed data: %d\n", *int_data);  
}

int main() {
    double value = 5.5;  // Initially, value is of type double
    process_data(&value);  // Incorrectly passing a double as an int
    return 0;
}

Explanation:

• In this vulnerable example, the process_data function assumes that the pointer data is pointing to an integer. However, it is possible to pass a pointer of a different type (e.g., double), leading to incorrect operations and potentially undefined behavior due to type confusion. This is because the function does not ensure the type of the data being processed.

How to fix Access of Resource Using Incompatible Type ('Type Confusion')?

To fix this vulnerability, ensure strict type checking and avoid using a generic void* pointer for operations that require a specific data type. If multiple data types need to be handled, use a structure or tagged union to ensure the correct type is being used. Implement type checking to verify that the data being processed matches the expected type.

Fixed Code Example

// Fixed code with type checking
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// Define a structure to handle different types safely
typedef struct {
    enum { INT_TYPE, DOUBLE_TYPE } type;
    union {
        int intValue;
        double doubleValue;
    } data;
} TypedData;

// Function that safely processes data based on its type
void process_data(TypedData *typedData) {
    if (typedData->type == INT_TYPE) {  
        typedData->data.intValue += 10;  
        printf("Processed integer data: %d\n", typedData->data.intValue);  
    } else if (typedData->type == DOUBLE_TYPE) {  
        typedData->data.doubleValue += 10.0;  
        printf("Processed double data: %.2f\n", typedData->data.doubleValue);  
    } else {
        fprintf(stderr, "Unsupported data type\n");  
    }
}

int main() {
    TypedData data;
    data.type = DOUBLE_TYPE;  // Correctly specify the type
    data.data.doubleValue = 5.5;
    process_data(&data);  // Now safely processes the data
    return 0;
}

Explanation:

• The fixed version introduces a TypedData structure that encapsulates both the data and its type. This way, the process_data function performs type checking before processing, ensuring that the correct operations are applied based on the data type.
• By using a tagged union, we prevent type confusion and ensure that the operations are only conducted on the correct type, thus mitigating the vulnerability. This approach enhances type safety and prevents undefined behavior by ensuring that operations are only performed on compatible data types.