Weakness (CWE)
CWE-122: Heap-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the heap.
How to prevent it (7 mitigations)
-
Pre-design: Use a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
-
Operation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
Source: MITRE CWE-122
2,892 results · Clear filters · Feed
-
High 8.0
Volume Manager Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Volume Manager Driver allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Windows Overlay Filter Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Windows Overlay Filter Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Storage Management Provider Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally.
-
High 7.8
Active Directory Domain Services Elevation of Privilege Vulnerability
Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to elevate privileges locally.
-
High 7.4
Windows Fast FAT Driver Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
-
High 8.1
Microsoft JScript Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft JScript allows an unauthorized attacker to execute code over a network.
-
High 7.1
Microsoft Standard XPS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Standard XPS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.
-
High 8.0
Microsoft Standard XPS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Standard XPS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Microsoft Standard XPS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows NTFS Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET and Visual Studio Remote Code Execution Vulnerability
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
-
High 8.7
CommServe Denial of Service
CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
-
High 7.5
A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x …
-
High 8.4
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of …
-
High 8.4
In vdec, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of …
-
High 8.3
PJSIP: Heap overflow in the HTTP client
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d5956a, a heap buffer overflow exists in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP response body. This affects applications that use the PJ…
-
High 7.5
Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent at…
-
High 7.8
Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)
Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
-
High 8.1
NGINX ngx_http_js_module vulnerablility
Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externa…
-
High 8.8
Gvfs: sftp: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length a…
-
High 8.2
A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer
An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This…
-
High 7.1
A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on t…
-
High 7.8
Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)
Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
-
High 7.5
A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 all…
-
High 7.8
Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren->pPal = g_new0(WPGColorRGB, 256); When handling a WPG_COLORMAP reco…
-
High 8.8
A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-en…
-
High 7.8
ppp(8): missing length validation in mp_SetEnddisc()
mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code a…
-
High 8.8
ppp(8): incorrect length calculation in mp_Enddisc()
mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code a…
-
High 8.8
Buffer overflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code in…
-
High 8.8
Buffer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code i…