Type Confusion Detection
Detection Workflow
- Identify type operations: Find all type casts, virtual function calls, union usage, class hierarchies
- Analyze type safety: Check cast validation, assess vtable integrity, verify union usage correctness
- Trace object flow: Use
xrefs_to to trace objects, identify type changes, assess type consistency
- Assess exploitability: Can attacker control object type? Is there useful type confusion? Can attacker corrupt vtable?
Key Patterns
- Unsafe type casting: C-style casts without validation, reinterpret_cast without checks
- Vtable corruption: virtual function calls on corrupted objects, vtable pointer manipulation
- Union misuse: writing to one union member, reading another
- Polymorphism issues: base pointer used as derived without dynamic_cast
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, cast operation, base type, derived type, validation, vtable access, exploitability, attack scenario, impact, mitigation.
Severity Guidelines
- CRITICAL: Type confusion with code execution
- HIGH: Type confusion with data corruption
- MEDIUM: Type confusion with limited impact
- LOW: Type confusion with minor issues
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-type-confusion3description: Detects type confusion vulnerabilities by identifying unsafe type casts, vtable corruption, and polymorphism issues. Use when analyzing object-oriented code, type casting, or investigating C++ memory safety issues.4---5
6# Type Confusion Detection
7
8## Detection Workflow
9
101. **Identify type operations**: Find all type casts, virtual function calls, union usage, class hierarchies
112. **Analyze type safety**: Check cast validation, assess vtable integrity, verify union usage correctness
123. **Trace object flow**: Use `xrefs_to` to trace objects, identify type changes, assess type consistency
134. **Assess exploitability**: Can attacker control object type? Is there useful type confusion? Can attacker corrupt vtable?
14
15## Key Patterns
16
17- Unsafe type casting: C-style casts without validation, reinterpret_cast without checks
18- Vtable corruption: virtual function calls on corrupted objects, vtable pointer manipulation
19- Union misuse: writing to one union member, reading another
20- Polymorphism issues: base pointer used as derived without dynamic_cast
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, vulnerability, cast operation, base type, derived type, validation, vtable access, exploitability, attack scenario, impact, mitigation.
25
26## Severity Guidelines
27
28- **CRITICAL**: Type confusion with code execution
29- **HIGH**: Type confusion with data corruption
30- **MEDIUM**: Type confusion with limited impact
31- **LOW**: Type confusion with minor issues
32
33## See Also
34
35- `patterns.md` - Detailed detection patterns and exploitation scenarios
36- `examples.md` - Example analysis cases and code samples
37- `references.md` - CWE references and mitigation strategies
aibot88