Weakness (CWE)
CWE-120: Buffer Copy without Checking Size of Input
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
How to prevent it (8 mitigations)
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer.
Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Implementation
Consider adhering to the following rules when allocating and managing an application's memory:
- Double check that your buffer is as large as you specify.
- When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string.
- Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.
- If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
-
Operation
Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.
For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
Source: MITRE CWE-120
525 results · Clear filters · Feed
-
Critical 10.0
A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Pane…
-
Critical 9.8
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.…
-
Critical 9.8
Buffer Copy Without Checking Size of Input in Data Modem
Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.
-
Critical 9.8
Stack overflow vulnerability in the network acceleration module.Successful exploitation of this vulnerability may cause…
-
Critical 9.8
Potential jail escape vulnerabilities in netmap
A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could lead to kernel memory corruption. On systems configured to include netmap in their devfs_ruleset, a privileged process r…
-
Critical 9.3
Buffer copy without checking size of Input in Core
Memory corruption in Core while processing control functions.
-
Critical 9.8
Buffer Overflow vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via the l…
-
Critical 9.8
Buffer overflow vulnerability in the FLP module. Successful exploitation of this vulnerability may cause out-of-bounds …
-
Critical 9.8
uev (aka libuev) before 2.4.1 has a buffer overflow in epoll_wait if maxevents is a large number.
-
Critical 9.8
Totolink T6 HTTP POST Request main buffer overflow
A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v41 …
-
Critical 9.3
Buffer Copy without Checking Size of Input in HLOS
Memory corruption in HLOS while running playready use-case.
-
Critical 9.8
Buffer Copy without Checking Size of Input in Data Modem
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.
-
Critical 9.8CVE-2023-7095 EPSS 14%
Totolink A7100RU HTTP POST Request main buffer overflow
A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation …
-
Critical 9.8
In MicroHttpServer (aka Micro HTTP Server) through a8ab029, _ParseHeader in lib/server.c allows a one-byte recv buffer …
-
Critical 9.8
Totolink A7100RU HTTP POST Request main buffer overflow
A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument fla…
-
Critical 9.8CVE-2023-50245 Public exploit
OpenEXR-viewer memory overflow vulnerability
OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed in version 0.6.1.
-
Critical 9.8
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value…
-
Critical 9.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host
Memory corruption in WLAN Host while processing RRM beacon on the AP.
-
Critical 9.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
-
Critical 9.8
scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validatio…
-
Critical 9.8
Buffer Overflow vulnerability in Tenda Ac19 v.1.0, AC18, AC9 v.1.0, AC6 v.2.0 and v.1.0 allows a remote attacker to exe…
-
Critical 9.8
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code …
-
Critical 9.6
A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache valida…
-
Critical 9.8
Buffer Copy Without Checking Size of Input in WLAN Firmware
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
-
Critical 9.8
DreamSecurity MagicLine Buffer Overflow Vulnerability
A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code.
-
Critical 9.6
Stack-buffer Overflow in library module zbxjson
The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.
-
Critical 9.8
Tenda AC6 v15.03.05.19 is vulnerable to Buffer Overflow as the Index parameter does not verify the length.
-
Critical 9.8
General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow.
-
Critical 9.8
hutool Buffer Overflow vulnerability
hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.
-
Critical 9.8
hutool Buffer Overflow vulnerability
hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.
-
Critical 9.8
Buffer Copy Without Checking Size of Input in QESL
Memory corruption while handling payloads from remote ESL.
-
Critical 9.8
Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentica…
-
Critical 9.8
D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in…
-
Critical 9.8CVE-2023-29468 EPSS 10%
The Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC…
-
Critical 9.8
Buffer Copy Without Checking Size of Input in QESL
Memory corruption in QESL while processing payload from external ESL device to firmware.
-
Critical 9.8
Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially cra…
-
Critical 9.8
Open Babel has out-of-bounds write in CSR PadString (title field)
An out-of-bounds write vulnerability exists in the CSR format title functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this…
-
Critical 9.8
Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand para…
-
Critical 9.8CVE-2023-34563 EPSS 14%
netgear R6250 Firmware Version 1.0.4.48 is vulnerable to Buffer Overflow after authentication.
-
Critical 9.8
Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected d…