314
[REF-1333]Dmitry Evtyushkin, Dmitry Ponomarev, Nael Abu-Ghazaleh. "Jump Over ASLR:
Attacking Branch Predictors to Bypass ASLR". 2016. < http://www.cs.ucr.edu/~nael/pubs/
micro16.pdf >.2023-04-26.
[REF-1334]D3FEND. "Stack Frame Canary Validation (D3-SFCV)". 2023. < https://
d3fend.mitre.org/technique/d3f:StackFrameCanaryValidation/ >.2023-04-26.
[REF-1335]D3FEND. "Segment Address Offset Randomization (D3-SAOR)". 2023. < https://
d3fend.mitre.org/technique/d3f:SegmentAddressOffsetRandomization/ >.2023-04-26.
[REF-1336]D3FEND. "Process Segment Execution Prevention (D3-PSEP)". 2023. < https://
d3fend.mitre.org/technique/d3f:ProcessSegmentExecutionPrevention/ >.2023-04-26.
[REF-1337]Alexander Sotirov and Mark Dowd. "Bypassing Browser Memory Protections: Setting
back browser security by 10 years". 2008. < https://www.blackhat.com/presentations/bh-usa-08/
Sotirov_Dowd/bh08-sotirov-dowd.pdf >.2023-04-26.
CWE-121: Stack-based Buffer Overflow
Weakness ID : 121
Structure : Simple
Abstraction : Variant
Description
A stack-based buffer overflow condition is a condition where the buffer being overwritten is
allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 787 Out-of-bounds Write 1661
ChildOf 788 Access of Memory Location After End of Buffer 1669
Weakness Ordinalities
Primary :
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Background Details
There are generally several security-critical data on an execution stack that can lead to arbitrary
code execution. The most prominent is the stored return address, the memory address at which
execution should continue once the current function is finished executing. The attacker can
overwrite this value with some memory address to which the attacker also has write access,
into which they place arbitrary code to be run with the full privileges of the vulnerable program.
Alternately, the attacker can supply the address of an important call, for instance the POSIX
system() call, leaving arguments to the call on the stack. This is often called a return into libc
exploit, since the attacker generally forces the program to jump at return time into an interesting
routine in the C standard library (libc). Other important data commonly on the stack include the
stack pointer and frame pointer, two values that indicate offsets for computing memory addresses.
Modifying those values can often be leveraged into a "write-what-where" condition.
CWE Version 4.14
CWE-121: Stack-based Buffer Overflow
CWE-121: Stack-based Buffer Overflow