CWE-805 Detail

The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

When the length value exceeds the size of the destination, a buffer overflow could occur.

Introductiemodi

Implementation

Toepasselijke platforms

Taal

Class: Memory-Unsafe (Undetermined)
Name: C (Often)
Name: C++ (Often)
Class: Assembly (Undetermined)

Veelvoorkomende gevolgen

Waargenomen voorbeelden

Mogelijke risicobeperkingen

Phases : Requirements
Phases : Architecture and Design
Phases : Operation // Build and Compilation
Phases : Implementation
Phases : Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Phases : Operation // Build and Compilation
Phases : Operation
Phases : Architecture and Design // Operation
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the product or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Phases : Architecture and Design // Operation

Detectiemethoden

Automated Static Analysis

Effectiviteit : High

Automated Dynamic Analysis

This weakness can be detected using dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Effectiviteit : Moderate

Manual Analysis

Manual analysis can be useful for finding this weakness, but it might not achieve desired code coverage within limited time constraints. This becomes difficult for weaknesses that must be considered for all inputs, since the attack surface can be too large.

Automated Dynamic Analysis

Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].
Effectiviteit : Moderate

Notities kwetsbaarheidsmapping

Rechtvaardiging : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Opmerking : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Gerelateerde aanvalspatronen

Referenties

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-58

Address Space Layout Randomization in Windows Vista
Michael Howard.
https://learn.microsoft.com/en-us/archive/blogs/michael_howard/address-space-layout-randomization-in-windows-vista

REF-59

Limiting buffer overflows with ExecShield
Arjan van de Ven.
https://archive.is/saAFo

REF-60

PaX
https://en.wikipedia.org/wiki/Executable_space_protection#PaX

REF-741

Top 25 Series - Rank 12 - Buffer Access with Incorrect Length Value
Jason Lam.
https://web.archive.org/web/20100316043717/http://blogs.sans.org:80/appsecstreetfighter/2010/03/11/top-25-series-rank-12-buffer-access-with-incorrect-length-value/

REF-57

Safe C String Library v1.0.3
Matt Messier, John Viega.
http://www.gnu-darwin.org/www001/ports-1.5a-CURRENT/devel/safestr/work/safestr-1.0.3/doc/safestr.html

REF-56

Using the Strsafe.h Functions
Microsoft.
https://learn.microsoft.com/en-us/windows/win32/menurc/strsafe-ovw?redirectedfrom=MSDN

REF-61

Understanding DEP as a mitigation technology part 1
Microsoft.
https://msrc.microsoft.com/blog/2009/06/understanding-dep-as-a-mitigation-technology-part-1/

REF-76

Least Privilege
Sean Barnum, Michael Gegick.
https://web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/principles/least-privilege

REF-64

Position Independent Executables (PIE)
Grant Murphy.
https://www.redhat.com/en/blog/position-independent-executables-pie

REF-1332

Prelink and address space randomization
John Richard Moser.
https://lwn.net/Articles/190139/

REF-1333

Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR
Dmitry Evtyushkin, Dmitry Ponomarev, Nael Abu-Ghazaleh.
http://www.cs.ucr.edu/~nael/pubs/micro16.pdf

REF-1334

Stack Frame Canary Validation (D3-SFCV)
D3FEND.
https://d3fend.mitre.org/technique/d3f:StackFrameCanaryValidation/

REF-1335

Segment Address Offset Randomization (D3-SAOR)
D3FEND.
https://d3fend.mitre.org/technique/d3f:SegmentAddressOffsetRandomization/

REF-1336

Process Segment Execution Prevention (D3-PSEP)
D3FEND.
https://d3fend.mitre.org/technique/d3f:ProcessSegmentExecutionPrevention/

REF-1337

Bypassing Browser Memory Protections: Setting back browser security by 10 years
Alexander Sotirov and Mark Dowd.
https://www.blackhat.com/presentations/bh-usa-08/Sotirov_Dowd/bh08-sotirov-dowd.pdf

REF-1518

AddressSanitizer
https://clang.llvm.org/docs/AddressSanitizer.html

Indiening

Wijzigingen