VNX-1105: Insufficient Encapsulation of Machine-Dependent Functionality
C or C++ inline assembly (asm(...), asm volatile(...), __asm__ __volatile__(...), MSVC __asm/_asm { ... } blocks and single-line __asm/_asm instructions) appears in a file that is not a dedicated machine-dependent module, so CPU-specific code is mixed into general logic instead of being isolated behind a portable interface. Every port to a new architecture or compiler then has to find and rewrite it in place. A file counts as a dedicated module when it lives in a directory named for an architecture or platform layer (arch/, asm/, platform/, port/, hal/, cpu/, x86/, x86_64/, x86-64/, arm64/, aarch64/, riscv/, simd/, intrinsics/, atomic/ and similar) or its name says so (*atomic*, *intrin*, *simd*, barrier*, spinlock*, cpu*, *_x86, *_arm, *_avx2, *_neon, rdtsc*, platform*, osdep*, and the time-source modules monotonic*, clock*, timer*). Reported: the line opening each assembly statement. Not reported: inline assembly in such modules, calls to wrapper functions and compiler intrinsics, the asm keyword inside strings, identifiers that merely contain 'asm', and comments. Machine dependence other than inline assembly (system calls, intrinsics, preprocessor platform checks) is not judged.
| Field | Value |
|---|---|
| Rule ID | VNX-1105 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | C, C++ |
| CWE | CWE-1105 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | portability inline-assembly encapsulation cwe-1105 |
| Source | internal/sast/rules/vnx-1105.rego |
Overview
VNX-1105 maps to CWE-1105: Insufficient Encapsulation of Machine-Dependent Functionality. C or C++ inline assembly (asm(…), asm volatile(…), asm volatile(…), MSVC __asm/_asm { … } blocks and single-line __asm/_asm instructions) appears in a file that is not a dedicated machine-dependent module, so CPU-specific code is mixed into general logic instead of being isolated behind a portable interface. Every port to a new architecture or compiler then has to find and rewrite it in place. A file counts as a dedicated module when it lives in a directory named for an architecture or platform layer (arch/, asm/, platform/, port/, hal/, cpu/, x86/, x86_64/, x86-64/, arm64/, aarch64/, riscv/, simd/, intrinsics/, atomic/ and similar) or its name says so (atomic, intrin, simd, barrier*, spinlock*, cpu*, _x86, _arm, _avx2, _neon, rdtsc, platform, osdep, and the time-source modules monotonic, clock*, timer*). Reported: the line opening each assembly statement. Not reported: inline assembly in such modules, calls to wrapper functions and compiler intrinsics, the asm keyword inside strings, identifiers that merely contain ‘asm’, and comments. Machine dependence other than inline assembly (system calls, intrinsics, preprocessor platform checks) is not judged.
Why This Matters
Inline assembly scattered through business logic ties that logic to one CPU and one compiler. Porting to ARM or RISC-V, or building with MSVC instead of GCC, then means finding and rewriting each occurrence, and a missed one is a silent behaviour change or a build break.
What Gets Flagged
/* src/billing.c */
__asm__ __volatile__("rdtsc" : "=a"(lo), "=d"(hi)); // FLAGGED
asm volatile("mfence" ::: "memory"); // FLAGGED
__asm { mov eax, 1 } // FLAGGED (MSVC)Not flagged: the same code in src/arch/x86_64/cycles.c, cpu_x86.c or atomic_ops.h, assembly wrapped in a #define macro, calls to cpu_relax() or compiler intrinsics, and asm inside strings or comments.
Remediation
- Move the assembly into an architecture module (
arch/<cpu>/...) behind a small portable function or macro. - Prefer compiler builtins (
__atomic_thread_fence,__builtin_ia32_rdtsc) or C11<stdatomic.h>where they exist.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-1105
// nosec vnx-1105Or record an ignore rule: vulnetix ignore add --rule vnx-1105 --reason "...". See Suppressing findings.