CWE-354, Improper Validation of Integrity Check Value, is what you get when a message carries a checksum and the receiver either skips verifying it or verifies it wrongly. The data might have been changed or corrupted in transit, and nothing notices.
It is an implementation mistake, and it hits developers of network clients, update mechanisms and device software.
How it happens
The protocol specification describes the checksum algorithm. MITRE notes that implementing the calculation and comparing the calculated value to the received one is simple. That simplicity is exactly why it gets skipped, stubbed out for testing and never restored, or done after the data has already been parsed.
Common mistakes follow from the definition: not checking at all, checking only on some paths, ignoring the result, or comparing the wrong bytes.
The observed example is serious. CVE-2024-47573 describes a network analysis tool that did not properly validate an integrity check value, allowing installation of malicious firmware.
What an attacker gains
MITRE ties the consequences to three outcomes.
- Integrity checks often use a secret key that authenticates the origin. Skipping them opens the door to new data from an invalid source.
- Data that is parsed and used may be corrupted.
- Without the check it is impossible to tell whether the data was changed after sending.
How to find it
The record lists no detection methods. Look at the code that receives messages.
- Find where the checksum or signature is read, and follow the result. Is a failure fatal?
- Confirm the check runs before the data is parsed or acted on.
- Test with messages whose checksum is wrong. A correct receiver rejects every one.
A negative test is the best single control. Corrupt one byte and make sure the receiver refuses the message.
How to fix it
MITRE's mitigation: ensure the checksums present in messages are properly checked, in accordance with the protocol specification, before they are parsed and used.
The key phrase is before. A sketch of the right order:
def handle(frame):
body, received = frame[:-4], frame[-4:]
if not hmac.compare_digest(compute_check(body), received):
raise ValueError("integrity check failed")
return parse(body)
Two details are worth stating. Use a constant time comparison when the value guards authenticity. And remember that a plain checksum only detects accidents. When an attacker could alter messages, the check value should be a keyed or signed one.
Quick check
What is the safe order of operations on a received message?
Validate the integrity check value first, then parse and use the data, as MITRE advises.
Sources
- MITRE CWE-354: https://cwe.mitre.org/data/definitions/354.html
