CWE-122Heap-based Buffer Overflow

Description

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Common consequences

• Availability→DoS: Crash, Exit, or Restart,DoS: Resource Consumption (CPU),DoS: Resource Consumption (Memory)
  Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
• Integrity,Confidentiality,Availability,Access Control→Execute Unauthorized Code or Commands,Bypass Protection Mechanism,Modify Memory
  Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may
• Integrity,Confidentiality,Availability,Access Control,Other→Execute Unauthorized Code or Commands,Bypass Protection Mechanism,Other
  When the consequence is arbitrary code execution, this can often be used to subvert any other security service.

Potential mitigations

• Pre-design: Use a language or compiler that performs automatic bounds checking.
• Architecture and Design
  Use an abstraction library to abstract away risky APIs. Not a complete solution.
• Operation,Build and Compilation
  [object Object]
• Operation,Build and Compilation
  [object Object]
• Implementation
  Implement and perform bounds checking on input.
• Implementation
  Do not use dangerous functions such as gets. Look for their safe equivalent, which checks for the boundary.
• Operation
  Use OS-level preventative functionality. This is not a complete solution, but it provides some defense in depth.

Related CWEs

Recent CVEs classified under this CWE