Tag Archives: CWE- 125

CWE

CWE-125 – Out-of-bounds Read

Read Time:2 Minute, 9 Second

Description

The software reads data past the end, or before the beginning, of the intended buffer.

Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. A crash can occur when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string. The expected sentinel might not be located in the out-of-bounds memory, causing excessive data to be read, leading to a segmentation fault or a buffer overflow. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent read operation then produces undefined or unexpected results.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-119
CWE-119
CWE-119
CWE-119

 

Consequences

Confidentiality: Read Memory

Confidentiality: Bypass Protection Mechanism

By reading out-of-bounds memory, an attacker might be able to get secret values, such as memory addresses, which can be bypass protection mechanisms such as ASLR in order to improve the reliability and likelihood of exploiting a separate weakness to achieve code execution instead of just denial of service.

 

Potential Mitigations

Phase: Implementation

Description: 

Phase: Architecture and Design

Description: 

Use a language that provides appropriate memory abstractions.

CVE References

  • CVE-2014-0160
    • Chain: “Heartbleed” bug receives an inconsistent length parameter (CWE-130) enabling an out-of-bounds read (CWE-126), returning memory that could include private cryptographic keys and other sensitive data.
  • CVE-2018-10887
    • Chain: unexpected sign extension (CWE-194) leads to integer overflow (CWE-190), causing an out-of-bounds read (CWE-125)
  • CVE-2009-2523
    • Chain: product does not handle when an input string is not NULL terminated (CWE-170), leading to buffer over-read (CWE-125) or heap-based buffer overflow (CWE-122).
  • CVE-2018-16069
    • Chain: series of floating-point precision errors
      (CWE-1339) in a web browser rendering engine causes out-of-bounds read
      (CWE-125), giving access to cross-origin data
  • CVE-2004-0183
    • packet with large number of specified elements cause out-of-bounds read.
  • CVE-2004-0221
    • packet with large number of specified elements cause out-of-bounds read.
  • CVE-2004-0184
    • out-of-bounds read, resultant from integer underflow
  • CVE-2008-4113
    • OS kernel trusts userland-supplied length value, allowing reading of sensitive information