Page History

...

...

Related Vulnerabilities

CVE-2016-2208 results from a violation of this rule. The attacker can supply a value used to determine how much data is copied into a buffer via memcpy(), resulting in a buffer overlow of attacker-controlled data.

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

...

Taxonomy

...

Taxonomy item

...

Relationship

...

Related Vulnerabilities

CVE-2016-2208 results from a violation of this rule. The attacker can supply a value used to determine how much data is copied into a buffer via memcpy(), resulting in a buffer overlow of attacker-controlled data.

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-121 and ARR38-C

Intersection( CWE-121, ARR38-C) =

• Stack buffer overflow from passing invalid arguments to library function

CWE-121 – ARR38-C =

• Stack buffer overflows from direct out-of-bounds write

ARR38-C – CWE-121 =

• Out-of-bounds read from passing invalid arguments to library function

• Buffer overflow on heap or data segment from passing invalid arguments to library function

CWE-119 and ARR38-C

See CWE-119 and ARR30-C

CWE-125 and ARR38-C

Independent( ARR30-C, ARR38-C, EXP39-C, INT30-C)

STR31-C = Subset( Union( ARR30-C, ARR38-C))

STR32-C = Subset( ARR38-C)

Intersection( ARR38-C, CWE-125) =

• Reading from an out-of-bounds array index or off the end of an array via standard library function

ARR38-C – CWE-125 =

• Writing to an out-of-bounds array index or off the end of an array via standard library function

CWE-125 – ARR38-C =

• Reading beyond a non-array buffer

• Reading beyond an array directly (using pointer arithmetic, or [] notation)

CWE-805 and ARR38-C

Intersection( CWE-805, ARR38-C) =

• Buffer access with incorrect length via passing invalid arguments to library function

CWE-805 – ARR38-C =

• Buffer access with incorrect length directly (such as a loop construct)

ARR38-C – CWE-805 =

• Out-of-bounds read or write that does not involve incorrect length (could use incorrect offset instead), that uses library function

CWE-123 and ARR38-C

Independent(ARR30-C, ARR38-C)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-121 and ARR38-C

Intersection( CWE-121, ARR38-C) =

• Stack buffer overflow from passing invalid arguments to library function

CWE-121 – ARR38-C =

• Stack buffer overflows from direct out-of-bounds write

ARR38-C – CWE-121 =

• Out-of-bounds read from passing invalid arguments to library function

• Buffer overflow on heap or data segment from passing invalid arguments to library function

CWE-119 and ARR38-C

See CWE-119 and ARR30-C

CWE-125 and ARR38-C

Independent( ARR30-C, ARR38-C, EXP39-C, INT30-C) STR31-C = Subset( Union( ARR30-C, ARR38-C))

STR32-C = Subset( ARR38-C)

Intersection( ARR38-C, CWE-125) =

• Reading from an out-of-bounds array index or off the end of an array via standard library function

ARR38-C – CWE-125 =

• Writing to an out-of-bounds array index or off the end of an array via standard library function

CWE-125 – ARR38-C =

• Reading beyond a non-array buffer

• Reading beyond an array directly (using pointer arithmetic, or [] notation)

CWE-805 and ARR38-C

CWE-123 includes any operation that allows an attacker to write an arbitrary value to an arbitrary memory location. This could be accomplished via overwriting a pointer with data that refers to the address to write, then when the program writes to a pointed-to value, supplying a malicious value. Vulnerable pointer values can be corrupted by:

• Stack return address

• Buffer overflow on the heap (which typically overwrites back/next pointer values)

• Write to untrusted array index (if it is also invalid)

• Format string exploit

• Overwriting a C++ object with virtual functions (because it has a virtual pointer)

• Others?

Intersection( CWE-123Intersection( CWE-805, ARR38-C) =

• Buffer access with incorrect length overflow via passing invalid arguments to library function

CWE-805 – ARR38-C =

• Buffer access with incorrect length directly (such as a loop construct)

ARR38-C – CWE-805 =123 =

• Buffer overflow to “harmless” memory from passing invalid arguments to library function

• Out-of-bounds read or write that does not involve incorrect length (could use incorrect offset instead), that uses from passing invalid arguments to library function

CWE-123

...

– ARR38-C =

• Arbitrary writes that do not involve standard C library functions

...

CWE-129 and ARR38-C

) STR31-C = Subset( Union( ARR30-C, ARR38-C )) STR32 -C = Subset( ARR38-C)

CWE-123 includes any operation that allows an attacker to write an arbitrary value to an arbitrary memory location. This could be accomplished via overwriting a pointer with data that refers to the address to write, then when the program writes to a pointed-to value, supplying a malicious value. Vulnerable pointer values can be corrupted by:

• Stack return address

• Buffer overflow on the heap (which typically overwrites back/next pointer values)

• Write to untrusted array index (if it is also invalid)

• Format string exploit

• Overwriting a C++ object with virtual functions (because it has a virtual pointer)

• Others?

Intersection( CWE-123, ARR38-C) =

• Buffer overflow via passing invalid arguments to library function

ARR38-C – CWE-123 =

• Buffer overflow to “harmless” memory from passing invalid arguments to library function

• Out-of-bounds read from passing invalid arguments to library function

CWE-123 – ARR38-C =

...

CWE-129 = making library functions create invalid pointers without using untrusted data.

E.g. : char[3] array;

strcpy(array, "123456");

CWE-129 - ARR38-C = not validating an integer used as an array index or in pointer arithmetic

E.g.: void foo(int i) {

  char array[3];

  array[i];

}

Intersection(ARR38-C, CWE-129) = making library functions create invalid pointers using untrusted data.

eg: void foo(int i) {

  char src[3], dest[3];

  memcpy(dest, src, i);

}

Bibliography

...