338
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 125 Out-of-bounds Read 330
ChildOf 786 Access of Memory Location Before Start of Buffer 1658
Weakness Ordinalities
Primary :
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
Confidentiality Bypass Protection Mechanism
By reading out-of-bounds memory, an attacker might be
able to get secret values, such as memory addresses,
which can be bypass protection mechanisms such as
ASLR in order to improve the reliability and likelihood of
exploiting a separate weakness to achieve code execution
instead of just denial of service.
Observed Examples
Reference Description
CVE-2021-40985 HTML conversion package has a buffer under-read, allowing a crash
https://www.cve.org/CVERecord?id=CVE-2021-40985
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 970 SFP Secondary Cluster: Faulty Buffer Access 888 2405
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Research Gap
Under-studied.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Buffer under-read
Software Fault Patterns SFP8 Faulty Buffer Access
References
[REF-1034]Raoul Strackx, Yves Younan, Pieter Philippaerts, Frank Piessens, Sven Lachmund
and Thomas Walter. "Breaking the memory secrecy assumption". 2009 March 1. ACM. < https://
dl.acm.org/doi/10.1145/1519144.1519145 >.2023-04-07.
CWE Version 4.14
CWE-128: Wrap-around Error
CWE-128: Wrap-around Error