...
If privilege relinquishment conditions are left unchecked, any flaw in the program may lead to unintended system compromise corresponding to the more privileged user or group account.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
POS37-C | High | Probablehigh | probableYes | lowYes | P18 | L1 |
Automated Detection
Tool | Version | Checker | Description | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| user_defined | Soundly supported | |||||||||||
| Axivion Bauhaus Suite |
| CertC-POS37 | ||||||||||||
| Helix QAC |
| DF4876, DF4877, DF4878 | ||||||||||||
| Klocwork |
| SV.FIU.PROCESS_VARIANTS | ||||||||||||
| Parasoft C/C++test |
| SECURITY-44 | ImplementedCERT_C-POS37-a | Ensure that privilege relinquishment is successful | ||||||||||
| R2016b | Privilege drop not verified | Success of privilege relinquishment not verified
| CERT C: Rule POS37-C | Checks for priviledge drop not verified (rule fully covered) |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...