CWE-835 不可达退出条件的循环(无限循环) 类弱点 334 条 CVE 漏洞汇总,含 AI 中文分析。
CWE-835属于逻辑缺陷类漏洞,指程序包含无法到达退出条件的循环,导致无限执行。攻击者通常利用此缺陷发起拒绝服务攻击,通过触发无限循环耗尽服务器CPU资源或内存,使合法用户无法访问服务。开发者应避免此类问题,需确保循环变量在每次迭代中正确更新,并设置合理的边界检查或超时机制,保证循环最终能正常终止。
int processMessagesFromServer(char *hostaddr, int port) { ... int servsock; int connected; struct sockaddr_in servaddr; // create socket to connect to server servsock = socket( AF_INET, SOCK_STREAM, 0); memset( &servaddr, 0, sizeof(servaddr)); servaddr.sin_family = AF_INET; servaddr.sin_port = htons(port); servaddr.sin_addr.s_addr = inet_addr(hostaddr); do { // establish connection to server connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr)); // if connected then read and process messages from server if (connected > -1) { // read and process messages ... } // keep tr
int processMessagesFromServer(char *hostaddr, int port) { ... // initialize number of attempts counter int count = 0; do { // establish connection to server connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr)); // increment counter count++; // if connected then read and process messages from server if (connected > -1) { // read and process messages ... } // keep trying to establish connection to the server // up to a maximum number of attempts } while (connected < 0 && count < MAX_ATTEMPTS); // close socket and return success or failure ... }
public boolean isReorderNeeded(String bookISBN, int rateSold) { boolean isReorder = false; int minimumCount = 10; int days = 0; // get inventory count for book int inventoryCount = inventory.getIventoryCount(bookISBN); // find number of days until inventory count reaches minimum while (inventoryCount > minimumCount) { inventoryCount = inventoryCount - rateSold; days++; } // if number of days within reorder timeframe // set reorder return boolean to true if (days > 0 && days < 5) { isReorder = true; } return isReorder; }
public boolean isReorderNeeded(String bookISBN, int rateSold) { ... // validate rateSold variable if (rateSold < 1) { return isReorder; } ... }
| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-34334 | Exiv2 安全漏洞 — exiv2 | 5.5 | Medium | 2021-08-09 |
| CVE-2021-37621 | Exiv2 处理逻辑错误漏洞 — exiv2 | 5.5 | Medium | 2021-08-09 |
| CVE-2021-37622 | Exiv2 安全漏洞 — exiv2 | 5.5 | Medium | 2021-08-09 |
| CVE-2021-37623 | Exiv2 安全漏洞 — exiv2 | 5.5 | Medium | 2021-08-09 |
| CVE-2021-34332 | Siemens Jt2go 和 Siemens Teamcenter Visualization 安全漏洞 — JT2Go | 5.5 | - | 2021-07-13 |
| CVE-2021-21279 | Contiki-NG 安全漏洞 — contiki-ng | 7.5 | High | 2021-06-18 |
| CVE-2021-3468 | Avahi 安全漏洞 — avahi | 5.5 | - | 2021-06-02 |
| CVE-2021-29591 | Google TensorFlow 安全漏洞 — tensorflow | 7.3 | High | 2021-05-14 |
| CVE-2021-29510 | pydantic 安全漏洞 — pydantic | 3.3 | Low | 2021-05-13 |
| CVE-2021-29482 | xz 安全漏洞 — xz | 7.5 | High | 2021-04-28 |
| CVE-2021-3508 | PDFResurrect 安全漏洞 — PDFResurrect | 5.5 | - | 2021-04-28 |
| CVE-2021-25663 | Siemens Nucleus 安全漏洞 — Capital Embedded AR Classic 431-422 | 7.5 | High | 2021-04-22 |
| CVE-2021-25664 | Siemens Nucleus 安全漏洞 — Capital Embedded AR Classic 431-422 | 7.5 | High | 2021-04-22 |
| CVE-2021-0273 | Juniper Networks Junos OS和Junos OS Evolved 安全漏洞 — Junos OS | 5.3 | Medium | 2021-04-22 |
| CVE-2021-28657 | Apache Tika 安全漏洞 — Apache Tika | 5.5 | - | 2021-03-31 |
| CVE-2021-20270 | Red Hat Ansible Automation 安全漏洞 — python-pygments | 7.5 | - | 2021-03-23 |
| CVE-2021-3416 | QEMU 安全漏洞 — QEMU | 3.2 | - | 2021-03-18 |
| CVE-2021-25673 | Siemens SIMATIC 安全漏洞 — SIMATIC S7-PLCSIM V5.4 | 5.5 | - | 2021-03-15 |
| CVE-2021-20255 | QEMU 安全漏洞 — QEMU | 5.5 | - | 2021-03-09 |
| CVE-2018-20803 | Mongodb Server 输入验证错误漏洞 — MongoDB Server | 6.5 | Medium | 2020-11-23 |
| CVE-2020-25641 | Linux kernel 安全漏洞 — kernel | 5.5 | - | 2020-10-06 |
| CVE-2020-5761 | Grandstream HT800 series 安全漏洞 — Grandstream HT800 Series | 7.5 | - | 2020-07-29 |
| CVE-2019-5091 | LEAD Technologies LEADTOOLS 安全漏洞 — LEADTOOLS libltdic.so | 7.5 | - | 2019-12-11 |
| CVE-2019-5097 | Embedthis Software GoAhead 安全漏洞 — EmbedThis | 7.5 | - | 2019-12-03 |
| CVE-2019-3560 | fizz 缓冲区错误漏洞 — fizz | 7.5 | - | 2019-04-29 |
| CVE-2019-3900 | Linux kernel 资源管理错误漏洞 — Kernel | 7.7 | - | 2019-04-25 |
| CVE-2019-3833 | Openwsman 资源管理错误漏洞 — openwsman | 7.5 | - | 2019-03-14 |
| CVE-2019-3819 | Linux kernel 资源管理错误漏洞 — kernel: | 4.4 | - | 2019-01-25 |
| CVE-2018-14621 | libtirpc 安全漏洞 — libtirpc | 7.5 | - | 2018-08-30 |
| CVE-2016-9581 | OpenJPEG 缓冲区错误漏洞 — openjpeg2 | 8.1 | - | 2018-08-01 |
CWE-835(不可达退出条件的循环(无限循环)) 是常见的弱点类别,本平台收录该类弱点关联的 334 条 CVE 漏洞。