Tên: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Thông tin chung

Các cách xuất hiện

Implementation

Nền tảng áp dụng

Ngôn ngữ

Lớp: Memory-Unsafe (Undetermined)
Tên: Go (Undetermined)
Tên: C (Undetermined)
Tên: C++ (Undetermined)

Công nghệ

Lớp: ICS/OT (Often)

Hậu quả phổ biến

Phạm vi	Tác động	Khả năng xảy ra
Confidentiality	Read Memory Ghi chú: An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality	Bypass Protection Mechanism Ghi chú: Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability	DoS: Crash, Exit, or Restart Ghi chú: An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other	Varies by Context Ghi chú: The read operation could produce other undefined or unexpected results.

Ví dụ đã quan sát

Tài liệu tham khảo	Mô tả
CVE-2026-7320	Out-of-bounds read in audio processor used in a common web browser, allowing a read of the global data section
CVE-2023-1018	The reference implementation code for a Trusted Platform Module does not implement length checks on data, allowing for an attacker to read 2 bytes past the end of a buffer.
CVE-2020-11899	Out-of-bounds read in IP stack used in embedded systems, as exploited in the wild per CISA KEV.
CVE-2014-0160	Chain: "Heartbleed" bug receives an inconsistent length parameter (CWE-130) enabling an out-of-bounds read (CWE-126), returning memory that could include private cryptographic keys and other sensitive data.
CVE-2021-40985	HTML conversion package has a buffer under-read, allowing a crash
CVE-2018-10887	Chain: unexpected sign extension (CWE-194) leads to integer overflow (CWE-190), causing an out-of-bounds read (CWE-125)
CVE-2009-2523	Chain: product does not handle when an input string is not NULL terminated (CWE-170), leading to buffer over-read (CWE-125) or heap-based buffer overflow (CWE-122).
CVE-2018-16069	Chain: series of floating-point precision errors (CWE-1339) in a web browser rendering engine causes out-of-bounds read (CWE-125), giving access to cross-origin data
CVE-2004-0112	out-of-bounds read due to improper length check
CVE-2004-0183	packet with large number of specified elements cause out-of-bounds read.
CVE-2004-0221	packet with large number of specified elements cause out-of-bounds read.
CVE-2004-0184	out-of-bounds read, resultant from integer underflow
CVE-2004-1940	large length value causes out-of-bounds read
CVE-2004-0421	malformed image causes out-of-bounds read
CVE-2008-4113	OS kernel trusts userland-supplied length value, allowing reading of sensitive information

Các biện pháp giảm thiểu tiềm năng

Phases : Implementation
Phases : Architecture and Design
Use a language that provides appropriate memory abstractions.

Phương pháp phát hiện

Fuzzing

Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.
Hiệu quả : High

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Hiệu quả : High

Automated Dynamic Analysis

Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].
Hiệu quả : Moderate

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Mẫu tấn công liên quan

ID CAPEC	Tên mẫu tấn công
CAPEC-540	Overread Buffers An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Tài liệu tham khảo

REF-1034

Breaking the memory secrecy assumption
Raoul Strackx, Yves Younan, Pieter Philippaerts, Frank Piessens, Sven Lachmund, Thomas Walter.
https://dl.acm.org/doi/10.1145/1519144.1519145

REF-1035

The info leak era on software exploitation
Fermin J. Serna.
https://media.blackhat.com/bh-us-12/Briefings/Serna/BH_US_12_Serna_Leak_Era_Slides.pdf

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

REF-1518

AddressSanitizer
https://clang.llvm.org/docs/AddressSanitizer.html

REF-1534

Automated Technical Debt Measure, Version 2
OMG.
https://www.omg.org/spec/ATDM2/1.0/PDF

REF-1566

Golang Secure Coding Practices guide
OWASP.
https://github.com/OWASP/Go-SCP

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
CWE Content Team	MITRE	2008-09-08 +00:00	updated Applicable_Platforms, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
CWE Content Team	MITRE	2009-10-29 +00:00	updated Description
CWE Content Team	MITRE	2010-09-27 +00:00	updated Relationships
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Demonstrative_Examples, References, Relationships
CWE Content Team	MITRE	2014-06-23 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2015-12-07 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Causal_Nature, Observed_Examples, Taxonomy_Mappings
CWE Content Team	MITRE	2018-03-27 +00:00	updated Description
CWE Content Team	MITRE	2019-01-03 +00:00	updated Relationships
CWE Content Team	MITRE	2019-06-20 +00:00	updated Description, Related_Attack_Patterns
CWE Content Team	MITRE	2019-09-19 +00:00	updated Common_Consequences, Observed_Examples, Potential_Mitigations, References, Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Potential_Mitigations, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2020-06-25 +00:00	updated Observed_Examples, Potential_Mitigations
CWE Content Team	MITRE	2020-08-20 +00:00	updated Observed_Examples, Potential_Mitigations, Relationships
CWE Content Team	MITRE	2020-12-10 +00:00	updated Related_Attack_Patterns, Relationships
CWE Content Team	MITRE	2021-07-20 +00:00	updated Observed_Examples, Relationships
CWE Content Team	MITRE	2022-04-28 +00:00	updated Research_Gaps
CWE Content Team	MITRE	2022-06-28 +00:00	updated Observed_Examples, Relationships
CWE Content Team	MITRE	2022-10-13 +00:00	updated Applicable_Platforms, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Detection_Factors, References, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes, Relationships
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2024-07-16 +00:00	updated Alternate_Terms, Common_Consequences, Description, Diagram, Weakness_Ordinalities
CWE Content Team	MITRE	2024-11-19 +00:00	updated Observed_Examples, Relationships
CWE Content Team	MITRE	2025-09-09 +00:00	updated Affected_Resources, Demonstrative_Examples, Functional_Areas
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Detection_Factors, References, Relationships
CWE Content Team	MITRE	2026-10-28 +00:00	updated Applicable_Platforms, Demonstrative_Examples, Dimensions, Observed_Examples, References, Relationships, Taxonomy_Mappings

Chi tiết CWE-125

CWE-125