VNX-733: Compiler Optimization Removal or Modification of Security-critical Code

Reports C and C++ code the optimiser may delete: a memset/bzero of a secret buffer that nothing reads before it is freed or goes out of scope, and pointer-wraparound checks (p + n < p) on pointers, which are undefined behaviour.

Field	Value
Rule ID	`VNX-733`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-733
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`compiler-removal` `dead-store` `undefined-behaviour` `cwe-733`
Source	`internal/sast/rules/vnx-733.rego`

Overview

VNX-733 maps to CWE-733. It reports two shapes:

Dead-store wipe. memset/bzero/ZeroMemory/RtlZeroMemory with a zero fill, of a buffer whose name marks it as a secret: password, passphrase, secret, key, seed, pin, token, credential or plaintext, with prefixes such as session_key and camelCase forms such as masterKey. The next statement frees the buffer, or, for a local array, returns or closes the scope. Nothing reads the cleared memory afterwards, so the compiler may remove the clear.
Pointer-wraparound check. if (p + n < p) or p + n <= p on a name declared as a pointer. Pointer overflow is undefined behaviour, so the compiler may fold the test to false.

What Gets Flagged

memset(password, 0, 128);     // FLAGGED: dead store
free(password);

if (buf + off < buf)          // FLAGGED: UB, may be removed
    return -1;

Not reported:

wipes the compiler must keep: explicit_bzero, memset_s, SecureZeroMemory, OPENSSL_cleanse and sodium_memzero
a clear followed by a use of the buffer
clears of struct members or pointer parameters before a return
non-zero fills
integer overflow checks such as a + b < a on size_t
test code and comments

VNX-CWE1037-AUTO reports the dead-store wipe as well.

Remediation

Wipe secrets with explicit_bzero, memset_s, SecureZeroMemory or OPENSSL_cleanse.
Write bounds checks on lengths, for example n > (size_t)(end - p), and do not test pointer arithmetic for overflow.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-733
// nosec vnx-733

Or record an ignore rule: vulnetix ignore add --rule vnx-733 --reason "...". See Suppressing findings.