detecting-type-confusion

waiwai24's avatarfrom waiwai24

Detects type confusion vulnerabilities by identifying unsafe type casts, vtable corruption, and polymorphism issues. Use when analyzing object-oriented code, type casting, or investigating C++ memory safety issues.

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 26, 2025
[Security Operations]

When & Why to Use This Skill

This Claude skill provides advanced security analysis to detect type confusion vulnerabilities within object-oriented codebases. By identifying unsafe type casts, vtable corruption, and polymorphism issues, it enables developers and security researchers to proactively address memory safety risks in C++ and other low-level languages, significantly enhancing the security posture of complex software systems.

Use Cases

  • Security Vulnerability Research: Analyze complex C++ applications to find exploitable type confusion bugs, including vtable manipulation and union misuse.
  • Automated Code Auditing: Integrate into the code review process to automatically flag unsafe type casting and polymorphism issues before they reach production.
  • Root Cause Analysis: Investigate memory-related crashes by tracing object lifecycles and identifying where type consistency is lost during execution.
namedetecting-type-confusion
descriptionDetects type confusion vulnerabilities by identifying unsafe type casts, vtable corruption, and polymorphism issues. Use when analyzing object-oriented code, type casting, or investigating C++ memory safety issues.

Type Confusion Detection

Detection Workflow

  1. Identify type operations: Find all type casts, virtual function calls, union usage, class hierarchies
  2. Analyze type safety: Check cast validation, assess vtable integrity, verify union usage correctness
  3. Trace object flow: Use xrefs_to to trace objects, identify type changes, assess type consistency
  4. Assess exploitability: Can attacker control object type? Is there useful type confusion? Can attacker corrupt vtable?

Key Patterns

  • Unsafe type casting: C-style casts without validation, reinterpret_cast without checks
  • Vtable corruption: virtual function calls on corrupted objects, vtable pointer manipulation
  • Union misuse: writing to one union member, reading another
  • Polymorphism issues: base pointer used as derived without dynamic_cast

Output Format

Report with: id, type, subtype, severity, confidence, location, vulnerability, cast operation, base type, derived type, validation, vtable access, exploitability, attack scenario, impact, mitigation.

Severity Guidelines

  • CRITICAL: Type confusion with code execution
  • HIGH: Type confusion with data corruption
  • MEDIUM: Type confusion with limited impact
  • LOW: Type confusion with minor issues

See Also

  • patterns.md - Detailed detection patterns and exploitation scenarios
  • examples.md - Example analysis cases and code samples
  • references.md - CWE references and mitigation strategies