CWE-605 covers network services that allow multiple sockets to bind to the same port. When that is permitted, other services on the port may be stolen or spoofed.
How it happens
MITRE describes the mechanism. On most systems, setting the SO_REUSEADDR socket option and then calling bind() allows any process to bind to a port that a previous process bound with INADDR_ANY. A user can then bind to the specific address of a server that listens on INADDR_ANY on an unprivileged port, and steal its UDP packets or TCP connections.
int on = 1;
setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof on);
struct sockaddr_in a = { .sin_family = AF_INET,
.sin_port = htons(8080),
.sin_addr.s_addr = htonl(INADDR_ANY) }; /* wildcard */
bind(fd, (struct sockaddr *)&a, sizeof a);
Another local account runs a second program that binds the same port on the machine's specific address. Because a specific address is more precise than the wildcard, incoming traffic goes to the intruder.
What an attacker gains
The consequence in the record is confidentiality and integrity: packets from a variety of network services may be stolen, or the services spoofed.
How to find it
Static analysis (SAST) can find some instances by modelling data flow. In practice, grep for SO_REUSEADDR and for binds to INADDR_ANY or 0.0.0.0, then ask whether the service runs on a multi-user machine with an unprivileged port.
How to fix it
MITRE's mitigation is a policy one: restrict the server socket address to known local addresses.
- Bind to the specific interface your service needs, such as the loopback address for local-only services, instead of the wildcard.
- Use privileged ports for services that must not be spoofed, where the platform supports that.
- Do not set
SO_REUSEADDRunless you need quick restarts, and understand what it allows on your platform.
a.sin_addr.s_addr = htonl(INADDR_LOOPBACK); /* local-only service */
Quick check
Why does binding to a specific address help?
It removes the wildcard binding that another process can shadow, so there is no broader listener for an intruder to override.
