VNX-242: Use of Inherently Dangerous Function

Field	Value
Rule ID	VNX-242
Severity	High
SARIF level	error
Kind	sast
Languages	C, C++
CWE	CWE-242
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:H/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H
Tags	dangerous-function cwe-242 buffer-overflow
Source	internal/sast/rules/vnx-242.rego

Overview

VNX-242 maps to CWE-242: Use of Inherently Dangerous Function. It reports functions that cannot be called safely, because they write input of any length into a buffer they are given no size for:

• gets(), std::gets(), _getws(), getws(), _getts() and getwd();
• C++ extraction with operator>> from cin, wcin or a variable declared as an istream, ifstream, istringstream, stringstream or fstream into a char or wchar_t array with no std::setw() before it (unbounded before C++20).

Why This Matters

There is no input for which these calls are safe: the caller cannot tell them how big the buffer is, so a long line overflows it and overwrites the stack. gets() was removed from C11 and C++14 for this reason.

Not reported: the bounded replacements (fgets, gets_s, fgetws, getcwd), method calls with the same name (conn.gets(), p->gets()), prototypes, #define/#undef lines, extraction into std::string or numbers, shift expressions, comments and string literals. atoi/atol/atof are not inherently dangerous (they are unsafe only on unvalidated input, CWE-676) and are not reported here.

What Gets Flagged

char name[64];
gets(name);
getwd(dir);

char user[32];
std::cin >> user;

Remediation

if (fgets(name, sizeof name, stdin) == NULL)
    return 1;
getcwd(dir, sizeof dir);

std::string user;
std::cin >> user;                    // or: std::cin >> std::setw(sizeof user) >> user;

References

• CWE-242: Use of Inherently Dangerous Function
• CWE-120: Buffer Copy without Checking Size of Input

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-242
// nosec vnx-242

Or record an ignore rule: vulnetix ignore add --rule vnx-242 --reason "...". See Suppressing findings.