335
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 125 Out-of-bounds Read 330
ChildOf 788 Access of Memory Location After End of Buffer 1669
CanFollow 170 Improper Null Termination 428
Weakness Ordinalities
Primary :
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
Confidentiality Bypass Protection Mechanism
By reading out-of-bounds memory, an attacker might be
able to get secret values, such as memory addresses,
which can be bypass protection mechanisms such as
ASLR in order to improve the reliability and likelihood of
exploiting a separate weakness to achieve code execution
instead of just denial of service.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Demonstrative Examples
Example 1:
In the following C/C++ example the method processMessageFromSocket() will get a message from
a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains
the message length and the message body. A for loop is used to copy the message body into a
local character string which will be passed to another method for processing.
Example Language: C (Bad)
int processMessageFromSocket(int socket) {
int success;
char buffer[BUFFER_SIZE];
char message[MESSAGE_SIZE];
// get message from socket and store into buffer
//Ignoring possibliity that buffer > BUFFER_SIZE
if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {
// place contents of the buffer into message structure
ExMessage *msg = recastBuffer(buffer);
// copy message body into string for processing
int index;
for (index = 0; index < msg->msgLength; index++) {
message[index] = msg->msgBody[index];
CWE Version 4.14
CWE-126: Buffer Over-read
CWE-126: Buffer Over-read