COMMON WEAKNESS ENUMERATIONDraft

CWE-674

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Abstraction

Class

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Terminology

Alternate terms and usages

Stack Exhaustion

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

The uncontrolled recursion is often due to an improper or missing conditional

Risk

What does successful exploitation lead to?

DoS: Resource Consumption (CPU)DoS: Resource Consumption (Memory)

Affected security scopes: Availability

Resources including CPU, memory, and stack memory could be rapidly consumed or exhausted, eventually leading to an exit or crash.
Read Application Data

Affected security scopes: Confidentiality

In some cases, an application's interpreter might kill a process or thread that appears to be consuming too much resources, such as with PHP's memory_limit setting. When the interpreter kills the process/thread, it might report an error containing detailed information such as the application's installation path.

Defence

How is it prevented and fixed?

Implementation

Implementation-phase defence

Detail
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.

Effectiveness: Moderate

Implementation

Implementation-phase defence

Detail
Increase the stack size.

Effectiveness: Limited

Increasing the stack size might only be a temporary measure, since the stack typically is still not very large, and it might remain easy for attackers to cause an out-of-stack fault.

Verification

How is it detected?

Automated Static Analysis

High
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
CWE-674: Common Weakness Enumeration Entry CWE-674 · DayBreach Sözlük · DayBreach