Description

The software writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

Extended Description

This typically occurs when a pointer or its index is decremented to a position before the buffer, when pointer arithmetic results in a position before the beginning of the valid memory location, or when a negative index is used.

Likelihood of Exploit: Medium

Applicable Platforms
Language: C
Language: C++

Time Of Introduction

• Architecture and Design
• Implementation

Common Consequences

Detection Methods
None

Potential Mitigations

Relationships
This could be resultant from several errors, including a bad offset or an array index that decrements before the beginning of the buffer (see CWE-129).

Demonstrative Examples   (Details)

1. In the following C/C++ example, a utility function is used to trim trailing whitespace from a character string. The function copies the input string to a local character string and uses a while statement to remove the trailing whitespace by moving backward through the string and overwriting whitespace with a NUL character. (Demonstrative Example Id DX-87)
2. The following is an example of code that may result in a buffer underwrite, if find() returns a negative value to indicate that ch is not found in srcBuf: (Demonstrative Example Id DX-88)

Observed Examples

1. CVE-2002-2227 : Unchecked length of SSLv2 challenge value leads to buffer underflow.
2. CVE-2007-4580 : Buffer underflow from a small size value with a large buffer (length parameter inconsistency, CWE-130)
3. CVE-2007-1584 : Buffer underflow from an all-whitespace string, which causes a counter to be decremented before the buffer while looking for a non-whitespace character.
4. CVE-2007-0886 : Buffer underflow resultant from encoded data that triggers an integer overflow.
5. CVE-2006-6171 : Product sets an incorrect buffer size limit, leading to "off-by-two" buffer underflow.
6. CVE-2006-4024 : Negative value is used in a memcpy() operation, leading to buffer underflow.
7. CVE-2004-2620 : Buffer underflow due to mishandled special characters

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

References:

1. .Buffer UNDERFLOWS: What do you know about it?. Vuln-Dev Mailing List. 2004-01-10.
2. Michael Howard David LeBlanc John Viega .24 Deadly Sins of Software Security. McGraw-Hill. Section:'"Sin 5: Buffer Overruns." Page 89'. Published on 2010.