329
}
In the case where the substring is not found in destBuf, strstr() will return NULL, causing the
pointer arithmetic to be undefined, potentially setting the value of idx to a negative number. If idx is
negative, this will result in a buffer underwrite of destBuf.
Observed Examples
Reference Description
CVE-2021-24018 buffer underwrite in firmware verification routine allows code execution via a
crafted firmware image
https://www.cve.org/CVERecord?id=CVE-2021-24018
CVE-2002-2227 Unchecked length of SSLv2 challenge value leads to buffer underflow.
https://www.cve.org/CVERecord?id=CVE-2002-2227
CVE-2007-4580 Buffer underflow from a small size value with a large buffer (length parameter
inconsistency, CWE-130)
https://www.cve.org/CVERecord?id=CVE-2007-4580
CVE-2007-1584 Buffer underflow from an all-whitespace string, which causes a counter to be
decremented before the buffer while looking for a non-whitespace character.
https://www.cve.org/CVERecord?id=CVE-2007-1584
CVE-2007-0886 Buffer underflow resultant from encoded data that triggers an integer overflow.
https://www.cve.org/CVERecord?id=CVE-2007-0886
CVE-2006-6171 Product sets an incorrect buffer size limit, leading to "off-by-two" buffer
underflow.
https://www.cve.org/CVERecord?id=CVE-2006-6171
CVE-2006-4024 Negative value is used in a memcpy() operation, leading to buffer underflow.
https://www.cve.org/CVERecord?id=CVE-2006-4024
CVE-2004-2620 Buffer underflow due to mishandled special characters
https://www.cve.org/CVERecord?id=CVE-2004-2620
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 970 SFP Secondary Cluster: Faulty Buffer Access 888 2405
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Relationship
This could be resultant from several errors, including a bad offset or an array index that
decrements before the beginning of the buffer (see CWE-129).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER UNDER - Boundary beginning violation
('buffer underflow'?)
CLASP Buffer underwrite
Software Fault Patterns SFP8 Faulty Buffer Access
References
[REF-90]"Buffer UNDERFLOWS: What do you know about it?". Vuln-Dev Mailing List. 2004
January 0. < https://seclists.org/vuln-dev/2004/Jan/22 >.2023-04-07.
CWE Version 4.14
CWE-125: Out-of-bounds Read
CWE-125: Out-of-bounds Read