293
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 465 Pointer Issues 2328
Alternate Terms
Untrusted pointer offset : This term is narrower than the concept of "out-of-range" offset, since
the offset might be the result of a calculation or other error that does not depend on any externallysupplied
values.
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
If the untrusted pointer is used in a read operation,
an attacker might be able to read sensitive portions of
memory.
Availability DoS: Crash, Exit, or Restart
If the untrusted pointer references a memory location that
is not accessible to the program, or points to a location that
is "malformed" or larger than expected by a read or write
operation, the application may terminate unexpectedly.
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
Modify Memory
If the untrusted pointer is used in a function call, or
points to unexpected data in a write operation, then code
execution may be possible.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Observed Examples
Reference Description
CVE-2010-2160 Invalid offset in undocumented opcode leads to memory corruption.
https://www.cve.org/CVERecord?id=CVE-2010-2160
CVE-2010-1281 Multimedia player uses untrusted value from a file when using file-pointer
calculations.
https://www.cve.org/CVERecord?id=CVE-2010-1281
CWE Version 4.14
CWE-823: Use of Out-of-range Pointer Offset
CWE-823: Use of Out-of-range Pointer Offset