CWE-1335: Incorrect Bitwise Shift of Integer
An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.
How it's found
Incorrect Bitwise Shift of Integer is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Specifying a value to be shifted by a negative amount is undefined in various languages. Various computer architectures implement this action in different ways. The compilers and interpreters when generating code to accomplish a shift generally do not do a check for this issue. Specifying an over-shift, a shift greater than or equal to the number of bits contained in a value to be shifted, produces a result which varies by architecture and compiler. In some languages, this action is specifically listed as producing an undefined result.
Vulnerable vs. safe
unsigned int r = 1 << -5;reg_bit -= bit_number_from_elsewhere;if (NEED_TO_SHIFT){}return reg_bit;
unsigned int the_bit = 1 << the_bit_number;*r |= the_bit;int the_bit_number = choose_bit(5, 10);if ((the_bit_number > 0) && (the_bit_number < 63)){}return the_bit;int choose_bit(int reg_bit, int bit_number_from_elsewhere){}unsigned int handle_io_register(unsigned int *r){}Consequences
- DoS: Crash, Exit, or Restart
Mitigations
- Implementation: Implicitly or explicitly add checks and mitigation for negative or over-shift values.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-1335?
An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.
How do you find Incorrect Bitwise Shift of Integer?
Incorrect Bitwise Shift of Integer is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-1335?
DoS: Crash, Exit, or Restart
Does TurboPentest test for Incorrect Bitwise Shift of Integer?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest