CWE

Buffer Access Using Size of Source Buffer

ID: 806		Date: (C)2012-05-14   (M)2022-10-10
Type: weakness		Status: INCOMPLETE
Abstraction Type: Variant

Description

The software uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.

Extended Description

When the size of the destination is smaller than the size of the source, a buffer overflow could occur.

Likelihood of Exploit: Medium to High

Applicable Platforms
Language: C
Language: Sometimes
Language: C++
Language: Sometimes

Time Of Introduction

• Implementation

Common Consequences

Scope	Technical Impact	Notes
Availability	DoS: crash / exit / restart DoS: resource consumption (CPU)	Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity Confidentiality Availability	Execute unauthorized code or commands	Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy.
Access_Control	Bypass protection mechanism	When the consequence is arbitrary code execution, this can often be used to subvert any other security service.

Detection Methods
None

Potential Mitigations

Phase	Strategy	Description	Effectiveness	Notes
Architecture and Design		Use an abstraction library to abstract away risky APIs. Examples include the Safe C String Library (SafeStr) by Viega, and the Strsafe.h library from Microsoft. This is not a complete solution, since many buffer overflows are not related to strings.
Build and Compilation		Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. This is not necessarily a complete solution, since these canary-based mechanisms only detect certain types of overflows. In addition, the result is still a denial of service, since the typical response is to exit the application.
Implementation		Programmers should adhere to the following rules when allocating and managing their applications memory: Double check that your buffer is as large as you specify. When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string. Check buffer boundaries if calling this function in a loop and make sure you are not in danger of writing past the allocated space. Truncate all input strings to a reasonable length before passing them to the copy and concatenation functions
Operation	Environment Hardening	Use a feature like Address Space Layout Randomization (ASLR) [R.806.3] [R.806.5].	Defense in Depth	This is not a complete solution. However, it forces the attacker to guess an unknown value that changes every program execution. In addition, an attack could still cause a denial of service, since the typical response is to exit the application.
Operation	Environment Hardening	Use a CPU and operating system that offers Data Execution Protection (NX) or its equivalent [R.806.5] [R.806.6].	Defense in Depth	This is not a complete solution, since buffer overflows could be used to overwrite nearby variables to modify the software's state in dangerous ways. In addition, it cannot be used in cases in which self-modifying code is required. Finally, an attack could still cause a denial of service, since the typical response is to exit the application.
Build and Compilation Operation		Most mitigating technologies at the compiler or OS level to date address only a subset of buffer overflow problems and rarely provide complete protection against even that subset. It is good practice to implement strategies to increase the workload of an attacker, such as leaving the attacker to guess an unknown value that changes every program execution.

Relationships

Related CWE	Type	View	Chain
CWE-806 ChildOf CWE-805	Weakness	CWE-1000 CWE-699

Demonstrative Examples   (Details)

1. In the following example, the source character string is copied to the dest character string using the method strncpy.
2. In this example, the method outputFilenameToLog outputs a filename to a log file. The method arguments include a pointer to a character string containing the file name and an integer for the number of characters in the string. The filename is copied to a buffer where the buffer size is set to a maximum size for inputs to the log file. The method then calls another method to save the contents of the buffer to the log file.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings
None

References:

1. Microsoft .Using the Strsafe.h Functions.
2. Matt Messier John Viega .Safe C String Library v1.0.3.
3. Michael Howard .Address Space Layout Randomization in Windows Vista.
4. Arjan van de Ven .Limiting buffer overflows with ExecShield.
5. .PaX.
6. Microsoft .Understanding DEP as a mitigation technology part 1.