2479 Vulnerability Patterns Fb8a1472

# Vulnerability Patterns and Root Causes

## Memory Safety Vulnerabilities

### Buffer Overflow
**Root Causes:**
- Missing bounds check on array/buffer access
- Incorrect size calculation (off-by-one)
- Assumption that input fits in fixed-size buffer
- Unsafe string functions (strcpy, sprintf)

**Example:**
```c
void process(char *input) {
    char buf[64];
    strcpy(buf, input);  // Root cause: assumes input < 64 bytes
}
```

### Use-After-Free
**Root Causes:**
- Dangling pointer not nulled after free
- Incorrect object lifetime management
- Missing reference counting
- Race condition on deallocation

**Example:**
```c
free(ptr);
// ... later ...
ptr->field = value;  // Root cause: pointer not invalidated
```

### Double-Free
**Root Causes:**
- Duplicate free on same pointer
- Incorrect ownership semantics
- Exception handling frees already-freed memory

### Null Pointer Dereference
**Root Causes:**
- Missing null check after allocation
- Unchecked return value from function
- Assumption that pointer is always valid

## Injection Vulnerabilities

### SQL Injection
**Root Causes:**
- String concatenation instead of parameterized queries
- Assumption that input is sanitized
- Insufficient escaping of special characters
- Trust boundary violation

**Example:**
```python
query = "SELECT * FROM users WHERE name = '" + user_input + "'"
# Root cause: treats untrusted input as code
```

### Command Injection
**Root Causes:**
- Passing unsanitized input to shell
- Using system() instead of exec family
- Insufficient input validation
- Metacharacter injection

### Cross-Site Scripting (XSS)
**Root Causes:**
- Unescaped user input in HTML output
- Incorrect context-aware encoding
- DOM-based manipulation with untrusted data
- Trust boundary violation

## Authentication/Authorization

### Authentication Bypass
**Root Causes:**
- Logic error in authentication check
- Missing authentication on sensitive endpoints
- Incorrect session validation
- State machine flaw

**Example:**
```python
if user.password == provided_password or user.is_admin:
    # Root cause: logic error allows admin bypass
    grant_access()
```

### Privilege Escalation
**Root Causes:**
- Missing authorization check
- Incorrect privilege validation
- TOCTOU on permission check
- Confused deputy problem

### Insecure Direct Object Reference
**Root Causes:**
- Missing ownership validation
- Assumption that user only accesses own data
- Predictable resource identifiers

## Cryptographic Vulnerabilities

### Weak Cryptography
**Root Causes:**
- Using deprecated algorithms (MD5, SHA1)
- Insufficient key length
- Hardcoded keys or passwords
- Predictable random number generation

### Improper Certificate Validation
**Root Causes:**
- Disabled certificate verification
- Incorrect hostname validation
- Accepting self-signed certificates

## Concurrency Vulnerabilities

### Race Condition
**Root Causes:**
- Missing synchronization on shared state
- TOCTOU between check and use
- Incorrect lock granularity
- Atomicity violation

**Example:**
```c
if (access(file, W_OK) == 0) {  // Check
    fd = open(file, O_WRONLY);   // Use
    // Root cause: file can change between check and use
}
```

### Deadlock
**Root Causes:**
- Circular lock dependency
- Incorrect lock ordering
- Missing timeout on lock acquisition

## Logic Vulnerabilities

### Integer Overflow
**Root Causes:**
- Missing overflow check on arithmetic
- Assumption that result fits in type
- Signed/unsigned confusion
- Wraparound behavior

**Example:**
```c
size_t total = count * size;  // Root cause: no overflow check
buffer = malloc(total);
```

### Off-by-One Error
**Root Causes:**
- Incorrect loop termination condition
- Confusion between size and last index
- Fencepost error in boundary calculation

### Type Confusion
**Root Causes:**
- Incorrect type casting
- Union type misuse
- Polymorphism without type checking

## Information Disclosure

### Path Traversal
**Root Causes:**
- Insufficient path sanitization
- Missing canonicalization
- Assumption that input is relative path

**Example:**
```python
file_path = base_dir + user_input
# Root cause: user_input can be "../../../etc/passwd"
```

### Information Leakage
**Root Causes:**
- Verbose error messages
- Debug information in production
- Timing side channels
- Missing access control on sensitive data

## Denial of Service

### Resource Exhaustion
**Root Causes:**
- Missing rate limiting
- Unbounded resource allocation
- No timeout on operations
- Algorithmic complexity attack

### Crash/Exception
**Root Causes:**
- Unhandled exception
- Assertion failure on invalid input
- Null pointer dereference
- Division by zero

## Pattern Recognition

### Common Indicators

1. **Trust Boundary Crossing**: Data flows from untrusted to trusted context
2. **Missing Validation**: Input used without checking constraints
3. **Unsafe API Usage**: Functions known to be dangerous (strcpy, system, eval)
4. **Complex Logic**: Intricate conditionals prone to errors
5. **Manual Memory Management**: Explicit malloc/free without RAII
6. **Concurrency**: Shared mutable state without synchronization
7. **Cryptographic Operations**: Custom crypto or weak algorithms