332
the code's environment changes. This can give attackers enough room to bypass the intended
validation. However, denylists can be useful for detecting potential attacks or determining
which inputs are so malformed that they should be rejected outright. To reduce the likelihood
of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations
for any length argument, buffer size calculation, or offset. Be especially careful of relying on a
sentinel (i.e. special character such as NUL) in untrusted inputs.
Phase: Architecture and Design
Strategy = Language Selection
Use a language that provides appropriate memory abstractions.
Demonstrative Examples
Example 1:
In the following code, the method retrieves a value from an array at a specific array index location
that is given as an input parameter to the method
Example Language: C (Bad)
int getValueFromArray(int *array, int len, int index) {
int value;
// check that the array index is less than the maximum
// length of the array
if (index < len) {
// get the value at the specified index of the array
value = array[index];
}
// if array index is invalid then output error message
// and return value indicating error
else {
printf("Value is: %d\n", array[index]);
value = -1;
}
return value;
}
However, this method only verifies that the given array index is less than the maximum length of
the array but does not check for the minimum value (CWE-839). This will allow a negative value
to be accepted as the input array index, which will result in a out of bounds read (CWE-125) and
may allow access to sensitive memory. The input array index should be checked to verify that is
within the maximum and minimum range required for the array (CWE-129). In this example the if
statement should be modified to include a minimum range check, as shown below.
Example Language: C (Good)
...
// check that the array index is within the correct
// range of values for the array
if (index >= 0 && index < len) {
...
Observed Examples
Reference Description
CVE-2020-11899 Out-of-bounds read in IP stack used in embedded systems, as exploited in the
wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-11899
CVE-2014-0160 Chain: "Heartbleed" bug receives an inconsistent length parameter (CWE-130)
enabling an out-of-bounds read (CWE-126), returning memory that could
include private cryptographic keys and other sensitive data.
https://www.cve.org/CVERecord?id=CVE-2014-0160
CWE Version 4.14
CWE-125: Out-of-bounds Read
CWE-125: Out-of-bounds Read