Incorrect Bitwise Shift of Integer
CWE-1335
An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value.
Specifying a value to be shifted by a negative amount is undefined in various languages. Various computer architectures implement this action in different ways. The compilers and interpreters when generating code to accomplish a shift generally do not do a check for this issue. Specifying an over-shift - a shift greater than or equal to the number of bits contained in a value to be shifted - produces a result that varies by architecture and compiler. In some languages, this action is undefined.
We track 2 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3.
How this weakness is prevented
- Implementation: Implicitly or explicitly add checks and mitigation for negative or over-shift values.
Latest Incorrect Bitwise Shift of Integer vulnerabilities
- 8.7 High severity
Apache Thrift: Stack-based Buffer Overflow
Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- 7.8 High severity
Linux: Incorrect Bitwise Shift of Integer
In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Add check for negative db_l2nbperpage l2nbperpage is log2(number of blks per page), and the minimum legal value should be 0, not negative. In the case of l2nbperpage being negative, an