CWE-1335: Incorrect Bitwise Shift of Integer
An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.
How it's found
Incorrect Bitwise Shift of Integer is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Specifying a value to be shifted by a negative amount is undefined in various languages. Various computer architectures implement this action in different ways. The compilers and interpreters when generating code to accomplish a shift generally do not do a check for this issue. Specifying an over-shift, a shift greater than or equal to the number of bits contained in a value to be shifted, produces a result which varies by architecture and compiler. In some languages, this action is specifically listed as producing an undefined result.
Vulnerable vs. safe
unsigned int r = 1 << -5;reg_bit -= bit_number_from_elsewhere;if (NEED_TO_SHIFT){}return reg_bit;
unsigned int the_bit = 1 << the_bit_number;*r |= the_bit;int the_bit_number = choose_bit(5, 10);if ((the_bit_number > 0) && (the_bit_number < 63)){}return the_bit;int choose_bit(int reg_bit, int bit_number_from_elsewhere){}unsigned int handle_io_register(unsigned int *r){}Consequences
- DoS: Crash, Exit, or Restart
Mitigations
- Implementation: Implicitly or explicitly add checks and mitigation for negative or over-shift values.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-1335?
An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.
How do you find Incorrect Bitwise Shift of Integer?
Incorrect Bitwise Shift of Integer is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-1335?
DoS: Crash, Exit, or Restart
Does TurboPentest test for Incorrect Bitwise Shift of Integer?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest