CWE-1339: Insufficient Precision or Accuracy of a Real Number
When a security decision or calculation requires highly precise, accurate numbers such as financial calculations or prices, then small variations in the number could be exploited by an attacker.
There are multiple ways to store the fractional part of a real number in a computer. In all of these cases, there is a limit to the accuracy of recording a fraction. If the fraction can be represented in a fixed number of digits (binary or decimal), there might not be enough digits assigned to represent the number. In other cases the number cannot be represented in a fixed number of digits due to repeating in decimal or binary notation (e.g. 0.333333...) or due to a transcendental number such as Π or √2. Rounding of numbers can lead to situations where the computer results do not adequately match the result of sufficiently accurate math.
Modes of Introduction
Phase | Note |
---|---|
Implementation | This weakness is introduced when the developer picks a method to represent a real number. The weakness may only be visible with very specific numeric inputs. |
Applicable Platforms
Type | Class | Name | Prevalence |
---|---|---|---|
Language | Not Language-Specific | ||
Operating_system | Not OS-Specific | ||
Architecture | Not Architecture-Specific | ||
Technology | Not Technology-Specific |
Relationships
View | Weakness | |||||||
---|---|---|---|---|---|---|---|---|
# ID | View | Status | # ID | Name | Abstraction | Structure | Status | |
CWE-1000 | Research Concepts | Draft | CWE-682 | Incorrect Calculation | Pillar | Simple | Draft | |
CWE-1000 | Research Concepts | Draft | CWE-190 | Integer Overflow or Wraparound | Base | Simple | Stable | |
CWE-1000 | Research Concepts | Draft | CWE-834 | Excessive Iteration | Class | Simple | Incomplete | |
CWE-1000 | Research Concepts | Draft | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Class | Simple | Stable |