The following code uses the supplied number to output the corresponding element from an array. This error typically occurs, when a pointer or its index is decremented to a position that precedes the buffer, or when negative index is used. This issue describes a case where software reads or writes to buffer using an index or a pointer that references a memory location prior to the beginning of the buffer. As a result, an attacker might be able to pass a large input to application that result in buffer errors.įor more information, see: 1.5 CWE-786: Access of Memory Location Before Start of Buffer This weakness describes a situation when the length of attacker controlled input is inconsistent with length of the associated data. 1.4 CWE-130: Improper Handling of Length Parameter Inconsistency The error in code results in out of bound read and potentially allows access to sensitive information stored in memory.

The value of 'index' is supposed to be lower than value of 'len', this allows however a negative value to be passed as an array index. The following example in C briefly demonstrates the weakness: This weakness describes a case where a pointer or its index is used to access data beyond the bounds of intended buffer, resulting in access to potentially sensitive information, application crash or code execution. The function pointer gets overwritten with memory address under attacker's control which might result in arbitrary code execution. This way the attacker is able to insert a memory address for the 'next' chunk and the value to write into that memory address into 'previous' chunk. When the free() call occurs, most memory allocation will rewrite the linked list using data from buffer2. In our case there is a 'previous' chunk (buffer1) and a 'next' chunk (probably 0). The allocation header usually keeps a linked list of memory chunks. its contents and allocation header as well after the strcpy() call. Since buffer2 is allocated after buffer1 and there is no input validation performed on buffer1, the input data passed to buffer1 can overwrite accounting information that system keeps for buffer2, e.g. The above example allocates two buffers with size of 256 each and copies user input into buffer1. In this paper we will cover some of the related weakness' classes: As a result, read and write operations might be performed on memory locations associated with another buffer, variables, data structures, etc. Certain languages allow direct memory addressing and do not automatically ensure that the addressed locations are valid for buffer that is being referenced. This weakness is often referred to as memory corruption. Due to absence or improper validation of input data, an attacker might be able to read or write data outside the intended buffer. Descriptionīuffer errors are common for software that performs operations on a memory buffer. Want to have an in-depth understanding of all modern aspects ofīuffer Errors ? Read carefully this article and bookmark it to get back later, we regularly update this page. ImmuniWeb > CWE Knowledge Base > Buffer Errors Buffer Errors īuffer Errors weakness describes improper restriction of operations within the bounds of a memory buffer. CWE-942: Overly Permissive Cross-domain WhitelistĬWE is a trademark of the MITRE Corporation.CWE-918: Server-Side Request Forgery (SSRF).CWE-799: Improper Control of Interaction Frequency.CWE-671: Lack of Administrator Control over Security.CWE-613: Insufficient Session Expiration.CWE-611: Improper Restriction of XML External Entity Reference ('XXE').CWE-434: Unrestricted Upload of File with Dangerous Type.CWE-427: Uncontrolled Search Path Element.CWE-345: Insufficient Verification of Data Authenticity.CWE-312: Cleartext Storage of Sensitive Information.CWE-306: Missing Authentication for Critical Function.CWE-297: Improper Validation of Certificate with Host Mismatch.CWE-236: Improper Handling of Undefined Parameters.CWE-211: Information Exposure Through Externally-Generated Error Message.CWE-130: Improper Handling of Length Parameter Inconsistency.

Buffer overflow attack explained