CWE-369, Divide By Zero, is exactly what it says: the product divides a value by zero. It looks minor. In a service that many people depend on, a crash someone can trigger on demand is an availability problem.
It hits any code that does arithmetic on input, from image parsers to billing logic.
How it happens
MITRE explains that this typically occurs when an unexpected value reaches the product, or when an error is not properly detected. It is common in calculations involving physical dimensions such as size, length, width and height.
The observed examples show how ordinary the triggers are.
- CVE-2007-3268: an invalid size value leads to divide by zero.
- CVE-2007-2723: "empty" content triggers divide by zero.
- CVE-2007-2237: a height value of 0 triggers divide by zero.
A zero in a header, an empty file, a missing field that defaults to zero. Each is easy for an attacker to supply.
What an attacker gains
MITRE lists availability: a divide by zero results in a crash. There is no data theft in the record, but repeated crashes can take a service down, and in some environments a crash restarts a privileged component.
How to find it
MITRE names two methods. Static analysis can find some instances by analyzing source code. Fuzzing generates large numbers of diverse inputs, random or algorithmic, and runs the code with them, which is well suited to hitting zero values.
Also do this by hand:
- Search for division and modulo operators.
- For each divisor, trace where it comes from. If any path starts at input, a file or a network field, it needs a guard.
- Add test cases with zero, empty and missing values.
How to fix it
MITRE lists no formal mitigations. The standard answer is to validate the divisor before dividing.
Vulnerable C:
int per_item(int total, int count) {
return total / count; /* crashes when count is 0 */
}
Guarded:
int per_item(int total, int count, int *out) {
if (count == 0) return -1;
*out = total / count;
return 0;
}
The caller then handles the error path instead of crashing. Two more habits help. Reject impossible values at the edge, so a size of zero never reaches the math. And decide what a sensible default result is when the input is empty, such as zero items meaning an average of zero, and write it down in code.
Quick check
Which test technique finds this class of bug well?
Fuzzing, because it generates many diverse inputs and will eventually produce zero or empty values in the places that divide.
What impact does MITRE list?
Availability, in the form of a crash.
Sources
- MITRE CWE-369: https://cwe.mitre.org/data/definitions/369.html
