1664
Effectiveness = Defense in Depth
These techniques do not provide a complete solution. For instance, exploits frequently use a bug
that discloses memory addresses in order to maximize reliability of code execution [REF-1337]. It
has also been shown that a side-channel attack can bypass ASLR [REF-1333]
Phase: Operation
Strategy = Environment Hardening
Use a CPU and operating system that offers Data Execution Protection (using hardware NX
or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX
[REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a
memory address that is part of the code segment. For more information on these techniques see
D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
Effectiveness = Defense in Depth
This is not a complete solution, since buffer overflows could be used to overwrite nearby
variables to modify the software's state in dangerous ways. In addition, it cannot be used in
cases in which self-modifying code is required. Finally, an attack could still cause a denial of
service, since the typical response is to exit the application.
Phase: Implementation
Replace unbounded copy functions with analogous functions that support length arguments,
such as strcpy with strncpy. Create these if they are not available.
Effectiveness = Moderate
This approach is still susceptible to calculation errors, including issues such as off-by-one errors
(CWE-193) and incorrectly calculating buffer lengths (CWE-131).
Demonstrative Examples
Example 1:
The following code attempts to save four different identification numbers into an array.
Example Language: C (Bad)
int id_sequence[3];
/* Populate the id array. */
id_sequence[0] = 123;
id_sequence[1] = 234;
id_sequence[2] = 345;
id_sequence[3] = 456;
Since the array is only allocated to hold three elements, the valid indices are 0 to 2; so, the
assignment to id_sequence[3] is out of bounds.
Example 2:
In the following code, it is possible to request that memcpy move a much larger segment of
memory than assumed:
Example Language: C (Bad)
int returnChunkSize(void *) {
/* if chunk info is valid, return the size of usable memory,
* else, return -1 to indicate an error
*/
...
}
int main() {
...
memcpy(destBuf, srcBuf, (returnChunkSize(destBuf)-1));
...
CWE Version 4.14
CWE-787: Out-of-bounds Write
CWE-787: Out-of-bounds Write