295
Nature Type ID Name Page
ParentOf 823 Use of Out-of-range Pointer Offset 1726
ParentOf 824 Access of Uninitialized Pointer 1729
ParentOf 825 Expired Pointer Dereference 1732
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Applicable Platforms
Language : C (Prevalence = Often)
Language : C++ (Prevalence = Often)
Language : Assembly (Prevalence = Undetermined)
Alternate Terms
Buffer Overflow : This term has many different meanings to different audiences. From a CWE
mapping perspective, this term should be avoided where possible. Some researchers, developers,
and tools intend for it to mean "write past the end of a buffer," whereas others use the same term
to mean "any read or write outside the boundaries of a buffer, whether before the beginning of the
buffer or after the end of the buffer." Still others using the same term could mean "any action after
the end of a buffer, whether it is a read or write." Since the term is commonly used for exploitation
and for vulnerabilities, it further confuses things.
buffer overrun : Some prominent vendors and researchers use the term "buffer overrun," but most
people use "buffer overflow." See the alternate term for "buffer overflow" for context.
memory safety : Generally used for techniques that avoid weaknesses related to memory access,
such as those identified by CWE-119 and its descendants. However, the term is not formal, and
there is likely disagreement between practitioners as to which weaknesses are implicitly covered by
the "memory safety" term.
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
Modify Memory
If the memory accessible by the attacker can be effectively
controlled, it may be possible to execute arbitrary code,
as with a standard buffer overflow. If the attacker can
overwrite a pointer's worth of memory (usually 32 or 64
bits), they can redirect a function pointer to their own
malicious code. Even when the attacker can only modify
a single byte arbitrary code execution can be possible.
Sometimes this is because the same problem can be
exploited repeatedly to the same effect. Other times it
is because the attacker can overwrite security-critical
application-specific data -- such as a flag indicating
whether the user is an administrator.
Availability
Confidentiality
Read Memory
DoS: Crash, Exit, or Restart
DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
CWE Version 4.14
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119: Improper Restriction of Operations
within the Bounds of a Memory Buffer 296
Scope Impact Likelihood
Out of bounds memory access will very likely result in the
corruption of relevant memory, and perhaps instructions,
possibly leading to a crash. Other attacks leading to lack of
availability are possible, including putting the program into
an infinite loop.
Confidentiality Read Memory
In the case of an out-of-bounds read, the attacker may
have access to sensitive information. If the sensitive
information contains system details, such as the current
buffers position in memory, this knowledge can be
used to craft further attacks, possibly with more severe
consequences.
Detection Methods
Automated Static Analysis
This weakness can often be detected using automated static analysis tools. Many modern tools
use data flow analysis or constraint-based techniques to minimize the number of false positives.
Automated static analysis generally does not account for environmental considerations when
reporting out-of-bounds memory operations. This can make it difficult for users to determine
which warnings should be investigated first. For example, an analysis tool might report buffer
overflows that originate from command line arguments in a program that is not expected to run
with setuid or other special privileges.
Effectiveness = High
Detection techniques for buffer-related errors are more mature than for most other weakness
types.
Automated Dynamic Analysis
This weakness can be detected using dynamic tools and techniques that interact with the
software using large test suites with many diverse inputs, such as fuzz testing (fuzzing),
robustness testing, and fault injection. The software's operation may slow down, but it should not
become unstable, crash, or generate incorrect results.
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for
partial coverage: Binary / Bytecode Quality Analysis Bytecode Weakness Analysis - including
disassembler + source code weakness analysis Binary Weakness Analysis - including
disassembler + source code weakness analysis
Effectiveness = SOAR Partial
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Web Application Scanner Web Services Scanner Database Scanners
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
CWE Version 4.14
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119: Improper Restriction of Operations
within the Bounds of a Memory Buffer