Lukas' Notes

Logic Vulnerability

3 min read

security

Definition

Logic Vulnerability

A logic vulnerability is a class of vulnerability in which the program’s logic — not its memory handling — admits an unintended behaviour. The program does exactly what its code says; the bug is that the code lets the attacker reach a state the designers never meant to allow, by exploiting arithmetic or business rules the program enforces incorrectly. Unlike the memory-safety cluster, no memory is corrupted — the state the program arrives at is internally consistent, just wrong.

Integer Overflow and Underflow

Arithmetic that wraps past the type's bounds

  • overflow — an arithmetic result exceeds the maximum value the integer type can hold and wraps around to a small or negative value. A length the program treats as small is actually huge; a count of bytes to copy is taken as wrapped and the subsequent copy overruns its destination.
  • underflow — symmetric at the low end. Subtracting from a value near the type’s minimum wraps to a huge positive value, so a buffer-size calculation, a price, a fee — any quantity the program intended to keep positive — silently becomes maximal.

The program applied the operation it was told to apply; the bug is that the type’s bounds are not the domain’s bounds, and the program trusted the former where it should have trusted the latter.

Business Logic

Flaws the business rules should forbid but the code alone cannot see

  • apply a discount twice — a voucher or coupon code the program accepts once per order, but a sequence of requests or a state machine lets it apply twice;
  • unlimited free trials — the trial counter resets on a malformed identity the program does not check, so the same account claims the trial indefinitely;
  • negative price purchase — a quantity or price field that the program subtracts but never bounds below zero, so a negative value leaves the buyer credited money rather than charged.

Each is a bug the business rules forbid but the code alone cannot see — the program has no model of “what the business means”, only the operations it was asked to perform. Logic vulnerabilities of this flavour are the hardest to detect automatically, because nothing in the program’s memory state contradicts the intended invariant; only an external specification can.

Adjacent Classes

Logic, taint, and parser-composition are siblings

Logic vulnerabilities neighbour two other classes the lecture catalogues:

The unifying property is that none of these corrupt memory — they all exploit the logic of how the program interprets inputs and states, and the residual defences are specifications (business rules, parser schemas, sanitizer policies) the program must enforce explicitly.

Backlinks