名称: Buffer Under-read
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.
基本信息
引入方式
Implementation : This typically occurs when the pointer or its index is decremented to a position before the buffer, when pointer arithmetic results in a position before the beginning of the valid memory location, or when a negative index is used. This may result in exposure of sensitive information or possibly a crash.适用平台
编程语言
类： Memory-Unsafe (Undetermined)名称： C (Undetermined)
名称： C++ (Undetermined)
常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Confidentiality | Read Memory | |
| Confidentiality | Bypass Protection Mechanism 注意： By reading out-of-bounds memory, an attacker might be able to get secret values, such as memory addresses, which can bypass protection mechanisms such as ASLR in order to improve the reliability and likelihood of exploiting a separate weakness to achieve code execution instead of just denial of service. |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2021-40985 | HTML conversion package has a buffer under-read, allowing a crash |
检测方法
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)有效性 : High
Automated Dynamic Analysis
Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].有效性 : Moderate
漏洞映射说明
依据 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.备注 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
备注
Under-studied.参考资料
REF-1034
Breaking the memory secrecy assumptionRaoul Strackx, Yves Younan, Pieter Philippaerts, Frank Piessens, Sven Lachmund, Thomas Walter.
https://dl.acm.org/doi/10.1145/1519144.1519145
REF-1035
The info leak era on software exploitationFermin J. Serna.
https://media.blackhat.com/bh-us-12/Briefings/Serna/BH_US_12_Serna_Leak_Era_Slides.pdf
REF-44
24 Deadly Sins of Software SecurityMichael Howard, David LeBlanc, John Viega.
REF-1518
AddressSanitizerhttps://clang.llvm.org/docs/AddressSanitizer.html
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| CWE Content Team | MITRE | updated Applicable_Platforms, Relationships, Taxonomy_Mappings, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Description, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Causal_Nature | |
| CWE Content Team | MITRE | updated Common_Consequences, References | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Affected_Resources, Common_Consequences, Demonstrative_Examples, Functional_Areas | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Description, Detection_Factors, Modes_of_Introduction, References |
