CWE-843 (使用不兼容类型访问资源(类型混淆)) — Vulnerability Class 538

538 vulnerabilities classified as CWE-843 (使用不兼容类型访问资源(类型混淆)). AI Chinese analysis included.

CWE-843, Type Confusion, is a critical memory safety weakness where a resource is initialized with one data type but subsequently accessed using an incompatible type. This discrepancy often triggers logical errors or undefined behavior, particularly in memory-unsafe languages like C and C++, where the program misinterprets the underlying bit patterns. Attackers typically exploit this vulnerability by crafting malicious inputs that force the application to treat a pointer or object as a different type, potentially leading to arbitrary code execution, data corruption, or denial of service. To mitigate this risk, developers must enforce strict type checking and validation at runtime. Utilizing memory-safe programming languages, implementing comprehensive unit tests for type assertions, and employing static analysis tools can effectively detect these mismatches before deployment, ensuring that resources are always accessed according to their intended definitions.

MITRE CWE Description

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access. While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways. This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.

Common Consequences (1)

Availability, Integrity, Confidentiality Read Memory, Modify Memory, Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart

When a memory buffer is accessed using the wrong type, it could read or write memory out of the bounds of the buffer, if the allocated buffer is smaller than the type that the code is attempting to access, leading to a crash and possibly code execution.

Examples (2)

The following code uses a union to support the representation of different types of messages. It formats messages differently, depending on their type.

#define NAME_TYPE 1 #define ID_TYPE 2 struct MessageBuffer { int msgType; union { char *name; int nameID; }; }; int main (int argc, char **argv) { struct MessageBuffer buf; char *defaultMessage = "Hello World"; buf.msgType = NAME_TYPE; buf.name = defaultMessage; printf("Pointer of buf.name is %p\n", buf.name); /* This particular value for nameID is used to make the code architecture-independent. If coming from untrusted input, it could be any value. */ buf.nameID = (int)(defaultMessage + 1); printf("Pointer of buf.name is now %p\n", buf.name); if (buf.msgType == NAME_TYPE) { printf("Message: %

Bad · C

The following PHP code accepts a value, adds 5, and prints the sum.

$value = $_GET['value']; $sum = $value + 5; echo "value parameter is '$value'<p>"; echo "SUM is $sum";

Bad · PHP

CVE ID	Title	CVSS	Severity	Published
CVE-2022-37377	Foxit PDF Editor 安全漏洞 — PDF Editor	7.8	-	2023-03-29
CVE-2023-1077	Linux kernel安全漏洞 — Linux kernel	7.8	-	2023-03-27
CVE-2023-0083	The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access. — OpenHarmony	4.0	Medium	2023-03-10
CVE-2023-22579	Sequalize - Unsafe fall-through in getWhereConditions — Sequelize.js	9.9	Critical	2023-02-16
CVE-2023-21675	Windows Kernel Elevation of Privilege Vulnerability — Windows 10 Version 1809	7.8	High	2023-01-10
CVE-2022-3903	Linux kernel 安全漏洞 — Kernel	4.3	-	2022-11-14
CVE-2022-2971	MZ Automation libIEC61850 Access of Resource Using Incompatible Type ('Type Confusion') — libIEC61850	8.6	High	2022-09-23
CVE-2022-34221	Adobe Acrobat Reader Type Confusion vulnerability could lead to Arbitrary code execution — Acrobat Reader	7.8	-	2022-07-15
CVE-2022-1786	Linux kernel 安全漏洞 — kernel	7.8	-	2022-05-31
CVE-2021-32965	Delta Electronics DIAScreen - Type Confusion, Out-of-bounds Write — DIAScreen	7.8	High	2022-05-24
CVE-2022-29209	Type confusion leading to `CHECK`-failure based denial of service in TensorFlow — tensorflow	5.5	Medium	2022-05-20
CVE-2022-1176	Loose comparison causes IDOR on multiple endpoints in livehelperchat/livehelperchat — livehelperchat/livehelperchat	7.5	-	2022-03-31
CVE-2021-46152	Siemens Simcenter Femap 安全漏洞 — Simcenter Femap V2020.2	7.8	-	2022-02-09
CVE-2021-34866	Linux kernel 安全漏洞 — Kernel	7.0	-	2022-01-25
CVE-2021-24044	Facebook Hermes 安全漏洞 — Hermes	9.8	-	2022-01-15
CVE-2021-24045	Facebook Hermes 安全漏洞 — Hermes	9.1	-	2021-12-13
CVE-2021-41190	Clarify Content-Type handling in OCI spec — distribution-spec	3.0	Low	2021-11-17
CVE-2021-31344	Siemens Nucleus ReadyStart 安全漏洞 — Capital Embedded AR Classic 431-422	5.3	Medium	2021-11-09
CVE-2021-39841	Adobe Acrobat Pro DC DocMedia Type Confusion Remote Code Execution Vulnerability — Acrobat Reader	7.8	-	2021-09-29
CVE-2021-39219	Wrong type for `Linker`-define functions when used across two `Engine`s — wasmtime	6.3	Medium	2021-09-17
CVE-2021-35986	Adobe Acrobat Pro DC getAnnot Type Confusion Information Disclosure Vulnerability — Acrobat Reader	3.3	Low	2021-08-20
CVE-2021-28643	Adobe Acrobat Pro DC embedDocAsDataObject Type Confusion Information Disclosure Vulnerability — Acrobat Reader	3.3	Low	2021-08-20
CVE-2021-31476	Foxit PhantomPDF 安全漏洞 — PhantomPDF	7.8	-	2021-06-16
CVE-2021-31480	OpenText Brava! 安全漏洞 — Brava! Desktop	7.8	-	2021-06-15
CVE-2021-29519	CHECK-fail in SparseCross due to type confusion — tensorflow	2.5	Low	2021-05-14
CVE-2021-31461	Foxit Reader 安全漏洞 — Reader	7.8	-	2021-05-07
CVE-2020-27257	Omron CX-One — CX-One	7.8	-	2021-02-09
CVE-2020-26990	Siemens Jt2go和Siemens Teamcenter Visualization 安全漏洞 — JT2Go	8.0	-	2021-01-12
CVE-2020-26980	Siemens Jt2go 和 Siemens Teamcenter Visualization 授权问题漏洞 — JT2Go	8.8	-	2021-01-12
CVE-2020-27293	Delta Electronics CNCSoft-B 安全漏洞 — Delta Electronics	7.8	-	2021-01-11

Vulnerabilities classified as CWE-843 (使用不兼容类型访问资源(类型混淆)) represent 538 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.