VNX-605: Multiple Binds to the Same Port

Field	Value
Rule ID	VNX-605
Severity	Medium
SARIF level	warning
Kind	sast
Languages	C, C++, Go, Python
CWE	CWE-605
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	multiple-binds-same-port cwe-605
Source	internal/sast/rules/vnx-605.rego

Overview

VNX-605 maps to CWE-605: Multiple Binds to the Same Port. It reports socket options that let another socket bind the port a service listens on:

• setsockopt(..., SO_REUSEPORT, ...) in C and C++, including a call split over several lines.
• unix.SetsockoptInt / syscall.SetsockoptInt(fd, ..., SO_REUSEPORT, <non-zero>) in Go, also with the arguments on the following lines.
• sock.setsockopt(..., socket.SO_REUSEPORT, <non-zero>) and reuse_port=True (asyncio create_server) in Python.
• setsockopt(..., SO_REUSEADDR, ...) in a Winsock file (winsock2.h, ws2tcpip.h, windows.h) that never sets SO_EXCLUSIVEADDRUSE.

Not reported: SO_REUSEADDR on POSIX (it only allows reuse of an address in TIME_WAIT), Winsock files that also set SO_EXCLUSIVEADDRUSE, SO_REUSEPORT set to 0 or False, getsockopt reads of the option, #ifdef SO_REUSEPORT, and the option name in strings or comments.

Why This Matters

With SO_REUSEPORT (Linux, BSD) any socket of the same user can bind the same address and port, and the kernel then spreads new connections across all of them, so a second process can take over part of the service’s traffic. On Windows SO_REUSEADDR is worse: it lets any process bind over an active listener and steal or spoof its connections.

What Gets Flagged

setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));

serr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_REUSEPORT, 1)

#include <winsock2.h>
setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (const char *)&reuse, sizeof(reuse));

sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEPORT, 1)
server = await loop.create_server(handler, port=port, reuse_port=True)

Remediation

1. Drop SO_REUSEPORT unless the service deliberately load-balances across its own sockets, and then run them under a dedicated user.
2. On Windows, set SO_EXCLUSIVEADDRUSE on listening sockets instead of SO_REUSEADDR.
3. For a confirmed false positive, add a // vulnetix-ignore: VNX-605 comment on the line.

References

• CWE-605: Multiple Binds to the Same Port
• Microsoft: Using SO_REUSEADDR and SO_EXCLUSIVEADDRUSE

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-605
// nosec vnx-605

Or record an ignore rule: vulnetix ignore add --rule vnx-605 --reason "...". See Suppressing findings.