CME-119

Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer)

Description

Compiler-enforced runtime detection of integer overflow and unsafe numeric type conversions. Encompasses: (1) GCC/Clang -ftrapv — traps on signed integer overflow at ~2-5% overhead, suitable for production; (2) UBSan integer sanitizers (-fsanitize=signed-integer-overflow, -fsanitize=unsigned-integer-overflow, -fsanitize=implicit-conversion) — detect signed/unsigned overflow and implicit narrowing/sign-change conversions at runtime with configurable abort or logging; (3) MSVC /RTCc — detects data loss from runtime type conversions. When enabled, integer conversion errors that would silently produce incorrect values instead terminate the process, converting potential code execution vulnerabilities into denial-of-service conditions (a less severe outcome). Particularly effective against the dominant CWE-681 attack pattern where a negative signed value converted to unsigned becomes an enormous positive value that bypasses bounds checks and corrupts memory. Complements CME-116 (FORTIFY_SOURCE) which catches the buffer overflow consequence of integer conversion errors, while this control catches the conversion error itself at the point of occurrence.

CVSS Vector Impacts

Metric Transition Rationale
Attack Complexity (AC) L H Integer conversion errors (signed-to-unsigned confusion, implicit narrowing, overflow wrapping) are detected at the point of occurrence and the process is terminated before the corrupted value reaches memory operations; the attacker must find a conversion path in code that is not instrumented by the sanitizer or reach the vulnerable operation through an alternative call chain that bypasses the compiler-inserted checks

CWE Relationships

Verification

Check that system packages are compiled with -ftrapv or UBSan integer sanitizers, or that binaries contain UBSan runtime symbols indicating instrumented integer operations

$ rpm -q --queryformat "%{OPTFLAGS}" redhat-rpm-config 2>/dev/null | grep -oE '\-ftrapv|\-fsanitize=integer|\-fsanitize=signed-integer-overflow'
# Expected: -ftrapv or -fsanitize flag present in system build flags
Platform: rhel
$ readelf -s /usr/bin/ls 2>/dev/null | grep -c __ubsan
# Expected: non-zero count indicates UBSan-instrumented integer operations
Platform: linux
$ objdump -d /usr/bin/coreutils 2>/dev/null | grep -c 'callq.*__ubsan_handle' || objdump -d /usr/bin/ls 2>/dev/null | grep -c 'callq.*__ubsan_handle'
# Expected: non-zero count indicates UBSan integer overflow handlers present
Platform: linux
$ Get-Content (Get-ChildItem 'C:\Program Files\Microsoft Visual Studio\*\*\VC\Auxiliary\Build\vcvarsall.bat' -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1) 2>$null | Select-String '/RTCc'
# Expected: /RTCc flag present in Visual Studio build configuration
Platform: windows
← CME-118: Protected File Links (Kernel Symlink/Hardlink Protection) CME-201: Zero Trust Gateway / Identity-Aware Proxy →