CWE-835 不可达退出条件的循环(无限循环) 类弱点 334 条 CVE 漏洞汇总,含 AI 中文分析。
CWE-835属于逻辑缺陷类漏洞,指程序包含无法到达退出条件的循环,导致无限执行。攻击者通常利用此缺陷发起拒绝服务攻击,通过触发无限循环耗尽服务器CPU资源或内存,使合法用户无法访问服务。开发者应避免此类问题,需确保循环变量在每次迭代中正确更新,并设置合理的边界检查或超时机制,保证循环最终能正常终止。
int processMessagesFromServer(char *hostaddr, int port) { ... int servsock; int connected; struct sockaddr_in servaddr; // create socket to connect to server servsock = socket( AF_INET, SOCK_STREAM, 0); memset( &servaddr, 0, sizeof(servaddr)); servaddr.sin_family = AF_INET; servaddr.sin_port = htons(port); servaddr.sin_addr.s_addr = inet_addr(hostaddr); do { // establish connection to server connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr)); // if connected then read and process messages from server if (connected > -1) { // read and process messages ... } // keep tr
int processMessagesFromServer(char *hostaddr, int port) { ... // initialize number of attempts counter int count = 0; do { // establish connection to server connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr)); // increment counter count++; // if connected then read and process messages from server if (connected > -1) { // read and process messages ... } // keep trying to establish connection to the server // up to a maximum number of attempts } while (connected < 0 && count < MAX_ATTEMPTS); // close socket and return success or failure ... }
public boolean isReorderNeeded(String bookISBN, int rateSold) { boolean isReorder = false; int minimumCount = 10; int days = 0; // get inventory count for book int inventoryCount = inventory.getIventoryCount(bookISBN); // find number of days until inventory count reaches minimum while (inventoryCount > minimumCount) { inventoryCount = inventoryCount - rateSold; days++; } // if number of days within reorder timeframe // set reorder return boolean to true if (days > 0 && days < 5) { isReorder = true; } return isReorder; }
public boolean isReorderNeeded(String bookISBN, int rateSold) { ... // validate rateSold variable if (rateSold < 1) { return isReorder; } ... }
| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-25144 | Liferay Portal和Liferay DXP 安全漏洞 — Portal | 4.1 | Medium | 2024-02-08 |
| CVE-2023-45233 | EDK2 安全漏洞 — edk2 | 7.5 | High | 2024-01-16 |
| CVE-2023-45232 | EDK2 安全漏洞 — edk2 | 7.5 | High | 2024-01-16 |
| CVE-2023-0437 | 编号已被CVE保留 — MongoDB C Driver | 5.3 | Medium | 2024-01-12 |
| CVE-2024-0211 | Wireshark 安全漏洞 — Wireshark | 7.8 | High | 2024-01-03 |
| CVE-2023-43511 | Qualcomm Chipsets 安全漏洞 — Snapdragon | 7.5 | High | 2024-01-02 |
| CVE-2023-6245 | Candid 安全漏洞 — Candid | 7.5 | High | 2023-12-08 |
| CVE-2023-40458 | Sierra Wireless ALEOS 安全漏洞 — ALEOS | 7.5 | High | 2023-11-29 |
| CVE-2023-42814 | Kyverno 安全漏洞 — kyverno | 3.1 | Low | 2023-11-13 |
| CVE-2023-42815 | Kyverno 安全漏洞 — kyverno | 3.1 | Low | 2023-11-13 |
| CVE-2023-5825 | GitLab 安全漏洞 — GitLab | 6.5 | Medium | 2023-11-06 |
| CVE-2023-20083 | Cisco Firepower Threat Defense 安全漏洞 — Cisco Firepower Threat Defense Software | 8.6 | High | 2023-11-01 |
| CVE-2023-1718 | Bitrix24 安全漏洞 — Bitrix24 | 7.5 | High | 2023-11-01 |
| CVE-2023-46250 | pypdf 安全漏洞 — pypdf | 5.1 | Medium | 2023-10-31 |
| CVE-2023-22325 | SoftEther VPN 安全漏洞 — SoftEther VPN | 5.9 | Medium | 2023-10-12 |
| CVE-2023-43645 | OpenFGA 安全漏洞 — openfga | 5.9 | Medium | 2023-09-26 |
| CVE-2023-1108 | Red Hat JBoss Enterprise Application Platform 安全漏洞 | 7.5 | High | 2023-09-14 |
| CVE-2023-3255 | QEMU 安全漏洞 — Red Hat Enterprise Linux 8 | 6.5 | Medium | 2023-09-13 |
| CVE-2023-4511 | Wireshark 安全漏洞 — Wireshark | 5.3 | Medium | 2023-08-24 |
| CVE-2023-20200 | Cisco 多款产品安全漏洞 — Cisco Unified Computing System (Managed) | 7.7 | High | 2023-08-23 |
| CVE-2023-20197 | ClamAV 安全漏洞 — Cisco Secure Endpoint | 7.5 | High | 2023-08-16 |
| CVE-2023-3748 | FRRouting 安全漏洞 — frr | 3.5 | Low | 2023-07-24 |
| CVE-2023-34966 | Samba 安全漏洞 — Red Hat Enterprise Linux 8 | 7.5 | High | 2023-07-20 |
| CVE-2023-36807 | PyPDF2 安全漏洞 — pypdf | 6.2 | Medium | 2023-06-30 |
| CVE-2023-20116 | Cisco Unified Communications Manager 安全漏洞 — Cisco Unified Communications Manager | 6.8 | Medium | 2023-06-28 |
| CVE-2023-36464 | PyPDF2 安全漏洞 — pypdf | 6.2 | Medium | 2023-06-27 |
| CVE-2023-35933 | OpenFGA 安全漏洞 — openfga | 5.9 | Medium | 2023-06-26 |
| CVE-2023-33305 | Fortinet FortiOS 安全漏洞 — FortiWeb | 4.9 | Medium | 2023-06-13 |
| CVE-2015-10103 | Forget It 安全漏洞 — Forget It | 2.8 | Low | 2023-04-17 |
| CVE-2022-37013 | Unified Automation OPC UA C++ Demo Server 安全漏洞 — OPC UA C++ Demo Server | 7.5 | - | 2023-03-29 |
CWE-835(不可达退出条件的循环(无限循环)) 是常见的弱点类别,本平台收录该类弱点关联的 334 条 CVE 漏洞。