CWE

Compiler Optimization Removal or Modification of Security-critical Code

ID: 733		Date: (C)2012-05-14   (M)2022-10-10
Type: weakness		Status: INCOMPLETE
Abstraction Type: Base

Description

The developer builds a security-critical protection mechanism into the software but the compiler optimizes the program such that the mechanism is removed or modified.

Applicable Platforms
Language: Often
Language: C
Language: Often
Language: C++
Language Class: All Compiled Languages

Related Attack Patterns

• CAPEC-10
• CAPEC-24
• CAPEC-46
• CAPEC-8
• CAPEC-9

Common Consequences

Scope	Technical Impact	Notes
Access_Control Other	Bypass protection mechanism Other

Detection Methods

Name	Description	Effectiveness	Notes
Black Box	This specific weakness is impossible to detect using black box methods. While an analyst could examine memory to see that it has not been scrubbed, an analysis of the executable would not be successful. This is because the compiler has already removed the relevant code. Only the source code shows whether the programmer intended to clear the memory or not, so this weakness is indistinguishable from others.
White Box	This weakness is only detectable using white box methods (see black box detection factor). Careful analysis is required to determine if the code is likely to be removed by the compiler.

Potential Mitigations
None

Relationships

Related CWE	Type	View	Chain
CWE-733 ChildOf CWE-907	Category	CWE-888

Demonstrative Examples
None

Observed Examples

1. CVE-2008-1685 : C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.

For more examples, refer to CVE relations in the bottom box.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings
None

References:

1. M. Howard D. LeBlanc .Writing Secure Code 2nd Edition. Microsoft. Section:'Chapter 9, "A Compiler Optimization Caveat" Page 322'. Published on 2002.