Read Time:4 Minute, 6 Second
Description
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit: High
Related Weaknesses
CWE-118
CWE-20
Consequences
Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands, Modify Memory
If the memory accessible by the attacker can be effectively controlled, it may be possible to execute arbitrary code, as with a standard buffer overflow. If the attacker can overwrite a pointer’s worth of memory (usually 32 or 64 bits), they can redirect a function pointer to their own malicious code. Even when the attacker can only modify a single byte arbitrary code execution can be possible. Sometimes this is because the same problem can be exploited repeatedly to the same effect. Other times it is because the attacker can overwrite security-critical application-specific data — such as a flag indicating whether the user is an administrator.
Availability, Confidentiality: Read Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Out of bounds memory access will very likely result in the corruption of relevant memory, and perhaps instructions, possibly leading to a crash. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Confidentiality: Read Memory
In the case of an out-of-bounds read, the attacker may have access to sensitive information. If the sensitive information contains system details, such as the current buffers position in memory, this knowledge can be used to craft further attacks, possibly with more severe consequences.
Potential Mitigations
Phase: Requirements
Description:
Phase: Architecture and Design
Description:
This is not a complete solution, since many buffer overflows are not related to strings.
Phase: Build and Compilation
Effectiveness: Defense in Depth
Description:
This is not necessarily a complete solution, since these mechanisms can only detect certain types of overflows. In addition, an attack could still cause a denial of service, since the typical response is to exit the application.
Phase: Implementation
Description:
Phase: Operation
Effectiveness: Defense in Depth
Description:
This is not a complete solution. However, it forces the attacker to guess an unknown value that changes every program execution. In addition, an attack could still cause a denial of service, since the typical response is to exit the application.
Phase: Operation
Effectiveness: Defense in Depth
Description:
Use a CPU and operating system that offers Data Execution Protection (NX) or its equivalent [REF-60] [REF-61].
This is not a complete solution, since buffer overflows could be used to overwrite nearby variables to modify the software’s state in dangerous ways. In addition, it cannot be used in cases in which self-modifying code is required. Finally, an attack could still cause a denial of service, since the typical response is to exit the application.
Phase: Implementation
Effectiveness: Moderate
Description:
Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.
This approach is still susceptible to calculation errors, including issues such as off-by-one errors (CWE-193) and incorrectly calculating buffer lengths (CWE-131).
CVE References
- CVE-2009-2550
- Classic stack-based buffer overflow in media player using a long entry in a playlist
- CVE-2009-2403
- Heap-based buffer overflow in media player using a long entry in a playlist
- CVE-2009-0689
- large precision value in a format string triggers overflow
- CVE-2009-1532
- malformed inputs cause accesses of uninitialized or previously-deleted objects, leading to memory corruption
- CVE-2009-1528
- chain: lack of synchronization leads to memory corruption
- CVE-2021-29529
- Chain: machine-learning product can have a heap-based
buffer overflow (CWE-122) when some integer-oriented bounds are
calculated by using ceiling() and floor() on floating point values
(CWE-1339)
- CVE-2009-0558
- attacker-controlled array index leads to code execution
- CVE-2009-0269
- chain: -1 value from a function call was intended to indicate an error, but is used as an array index instead.
- CVE-2009-0566
- chain: incorrect calculations lead to incorrect pointer dereference and memory corruption
- CVE-2009-1350
- product accepts crafted messages that lead to a dereference of an arbitrary pointer
- CVE-2009-0191
- chain: malformed input causes dereference of uninitialized memory
- CVE-2008-4113
- OS kernel trusts userland-supplied length value, allowing reading of sensitive information
- CVE-2005-1513
- Chain: integer overflow in securely-coded mail program leads to buffer overflow. In 2005, this was regarded as unrealistic to exploit, but in 2020, it was rediscovered to be easier to exploit due to evolutions of the technology.
- CVE-2003-0542
- buffer overflow involving a regular expression with a large number of captures
- CVE-2017-1000121
- chain: unchecked message size metadata allows integer overflow (CWE-190) leading to buffer overflow (CWE-119).
