CWE-1265: Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls

ID CWE-1265
Abstraction Base
Structure Simple
Status Draft
During execution of non-reentrant code, the product performs a call that unintentionally produces a nested invocation of the non-reentrant code.

In a complex product, a single function call may lead to many different possible code paths, some of which may involve deeply nested calls. It may be difficult to foresee all possible code paths that could emanate from a given function call. In some systems, an external actor can manipulate inputs to the system and thereby achieve a wide range of possible control flows. This is frequently a concern in products that execute scripts from untrusted sources. Examples of such products are web browsers and PDF readers. A weakness is present when one of the possible code paths resulting from a function call alters program state that the original caller assumes to be unchanged during the call.

Applicable Platforms

Type Class Name Prevalence
Language Not Language-Specific

Relationships

View Weakness
# ID View Status # ID Name Abstraction Structure Status
CWE-1000 Research Concepts Draft CWE-691 Insufficient Control Flow Management Pillar Simple Draft
CWE-1000 Research Concepts Draft CWE-663 Use of a Non-reentrant Function in a Concurrent Context Base Simple Draft
CWE-1000 Research Concepts Draft CWE-416 Use After Free Variant Simple Stable

Common Attack Pattern Enumeration and Classification (CAPEC)

The Common Attack Pattern Enumeration and Classification (CAPECâ„¢) effort provides a publicly available catalog of common attack patterns that helps users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities.

CAPEC at Mitre.org
# ID Name Weaknesses
CAPEC-74 Manipulating State CWE-1265
Loading...
Loading...