Weakness (CWE)
CWE-122: Heap-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the heap.
How to prevent it (7 mitigations)
-
Pre-design: Use a language or compiler that performs automatic bounds checking.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
-
Operation
Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.
Source: MITRE CWE-122
4,078 results · Feed
-
High 8.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
-
Medium 6.6
Windows Partition Management Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Partition Management Driver allows an authorized attacker to elevate privileges with a physical attack.
-
High 8.8
Visual Studio Remote Code Execution Vulnerability
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
-
High 8.8
Visual Studio Remote Code Execution Vulnerability
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
-
High 8.8
Windows DHCP Client Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to elevate privileges over an adjacent network.
-
High 7.8
Windows Hyper-V Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 8.8
Remote Desktop Services Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.
-
High 7.0
Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Storage Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Storage allows an unauthorized attacker to execute code over a network.
-
Medium 6.6
Windows Devices Human Interface Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Devices Human Interface allows an authorized attacker to elevate privileges with a physical attack.
-
Medium 4.1
Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Performance Counters Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Performance Counters allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows File Server Resource Management Service allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows XWizard Framework Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows XWizard Framework allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Fast FAT Driver Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Device Inventory Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Device Inventory allows an authorized attacker to elevate privileges locally.
-
High 7.5
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows JScript Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.
-
Medium 6.6
Windows USB Video Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
-
High 7.8
Windows Print Spooler Components Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows SMB Client Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally.
-
Medium 6.6
Windows Kernel Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges with a physical attack.
-
Critical 9.8
Windows Xbox Live Networking Service Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.
-
Medium 6.5
Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to deny service over a network.
-
High 7.0
Windows exFAT File System Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Diagnostic Policy Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Smart Card Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Print Spooler Components Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Task Scheduler Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Error Reporting Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Biometric Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Desktop Window Manager Elevation of Privilege Vulnerability
Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows AppX Package Manager Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows AppX Package Manager allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows USB Driver Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.