VNX-1102: Reliance on Machine-Dependent Data Representation
C and C++ code writes or reads the in-memory representation of a multi-byte value or a struct straight to or from a socket, file or stream: send/sendto/recv/recvfrom/write/read/pwrite/pread, fwrite/fread (including the fwrite(&x, 1, sizeof x, f) form and std:: or :: qualified calls), or an iostream .write/.read through reinterpret_cast, where the buffer is the address of a variable (&n) or a pointer and the size is sizeof of that variable, of a multi-byte scalar type (int, long, short, uint16_t/uint32_t/uint64_t, float, double, size_t) or of a struct. The bytes on the wire or on disk then depend on the host's byte order, type widths, alignment and struct padding, so another machine reads a different value. Reported: the call line. Not reported: a byte-order conversion of the same variable within a few lines (htonl/ntohl, htobe64/le64toh, bswap, cpu_to_le32, memrev), single-byte values (char, uint8_t, bool, sizeof(char)), byte buffers sized by sizeof(buf), constant counts such as write(fd, &c, 1), host-local kernel interfaces read and written in native order by design (eventfd, signalfd, timerfd, inotify, self-pipe wakeups, judged by the descriptor's name, and descriptors the same file creates with pipe()/pipe2() or socketpair()), and calls inside comments or strings.
| Field | Value |
|---|---|
| Rule ID | VNX-1102 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | C, C++ |
| CWE | CWE-1102 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | portability endianness serialization cwe-1102 |
| Source | internal/sast/rules/vnx-1102.rego |
Overview
VNX-1102 maps to CWE-1102: Reliance on Machine-Dependent Data Representation. C and C++ code writes or reads the in-memory representation of a multi-byte value or a struct straight to or from a socket, file or stream: send/sendto/recv/recvfrom/write/read/pwrite/pread, fwrite/fread (including the fwrite(&x, 1, sizeof x, f) form and std:: or :: qualified calls), or an iostream .write/.read through reinterpret_cast, where the buffer is the address of a variable (&n) or a pointer and the size is sizeof of that variable, of a multi-byte scalar type (int, long, short, uint16_t/uint32_t/uint64_t, float, double, size_t) or of a struct. The bytes on the wire or on disk then depend on the host’s byte order, type widths, alignment and struct padding, so another machine reads a different value. Reported: the call line. Not reported: a byte-order conversion of the same variable within a few lines (htonl/ntohl, htobe64/le64toh, bswap, cpu_to_le32, memrev), single-byte values (char, uint8_t, bool, sizeof(char)), byte buffers sized by sizeof(buf), constant counts such as write(fd, &c, 1), host-local kernel interfaces read and written in native order by design (eventfd, signalfd, timerfd, inotify, self-pipe wakeups, judged by the descriptor’s name, and descriptors the same file creates with pipe()/pipe2() or socketpair()), and calls inside comments or strings.
Why This Matters
A uint32_t length sent with send(sock, &len, sizeof(len), 0) arrives byte-swapped on a big-endian peer, and a struct written with fwrite carries the compiler’s padding and type widths. The reader then computes a different length or field value, which at best corrupts data and at worst drives a buffer size or an offset from a value nobody intended.
What Gets Flagged
send(sock, &len, sizeof(len), 0); // FLAGGED
fwrite(hdr, sizeof(struct db_header), 1, fp); // FLAGGED
read(fd, &n, sizeof(n)); // FLAGGED unless ntohl(n) follows
out.write(reinterpret_cast<const char *>(&s), sizeof(s)); // FLAGGED (C++)Not flagged: uint32_t wire = htonl(len); send(sock, &wire, sizeof(wire), 0);, write(fd, &c, 1), read(fd, buf, sizeof(buf)), single-byte values, and eventfd/signalfd/self-pipe descriptors.
Remediation
- Convert every multi-byte field to a fixed byte order before writing (
htonl,htobe64) and back after reading (ntohl,be64toh). - Serialise structs field by field, or use a defined format (Protocol Buffers, CBOR), never the raw struct.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-1102
// nosec vnx-1102Or record an ignore rule: vulnetix ignore add --rule vnx-1102 --reason "...". See Suppressing findings.