Buffer Under-read
A buffer under-read occurs when a program attempts to read data from a memory location positioned before the start of an allocated buffer.
This vulnerability typically happens due to incorrect pointer arithmetic, where a pointer is decremented past the buffer's beginning, or when a negative index is used in an array access. These operations cause the program to read from unintended memory regions that were not allocated for the buffer's use. Reading from memory preceding the buffer can expose sensitive information, such as remnants of other data structures, passwords, or encryption keys, leading to information disclosure. It can also cause the application to crash if it accesses protected or invalid memory addresses, resulting in a denial of service.
Impact: Read Memory
Impact: Bypass Protection Mechanism
By reading out-of-bounds memory, an attacker might be able to get secret values, such as memory addresses, which can bypass protection mechanisms such as ASLR in order to improve the reliability and likelihood of exploiting a separate weakness to achieve code execution instead of just denial of service.
ID : DX-100
In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the methodCode Example:
c// check that the array index is less than the maximum*
ccCode Example:
c// check that the array index is within the correct*
c- Memory Management
- Memory
- PLOVER
- Software Fault Patterns