CLI Baseline B11 - memory-safety defect (instrumentation-dependent)

cli-baseline-b11-memory-safety is a critical severity check in the cli-baseline category, written in shell. Its source is templates/cli-baseline/cli-baseline-b11-memory-safety.sh in cert-x-gen-templates.

What it checks

Drives over-length and boundary-shaped input at every argument and stdin, and reads the sanitizer runtime’s verdict. Declares sanitizer oracles so cxg skips it honestly on a build that cannot show the defect.

Header

Field	Value
Id	cli-baseline-b11-memory-safety
Severity	critical
Language	shell
Category	cli-baseline
Author	CERT-X-GEN / CLI Security Baseline
Template version	not recorded
Confidence	not recorded
CVSS	not recorded
Weakness	CWE-787
Tags	cli, baseline, memory-safety, cwe-787, cwe-125, cwe-416, instrumentation-dependent
Target kind	cli
Oracle	asan, ubsan, msan, tsan, overflow

Conventions of the repository, not fields the engine reads

@target_kinds and @oracles are documented in the templates repository’s contribution guide, and cxg’s annotation parser does not carry them into a template’s metadata. Nothing at scan time selects on them. The annotation header schema is every field the parser does read.

The file declares @allow_nonzero_exit as well. Those are not tabled above; read the source for what they carry.

Run it

To see what the copy on your machine says about itself, and to confirm it is installed at all:

cxg template info cli-baseline-b11-memory-safety

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Related

• Template catalog is the whole corpus.
• cli-baseline is the rest of this category.
• Templates by weakness class groups checks by the defect they look for.
• Contribute a template is the route from a check you needed and could not find to a merged one.