Out-of-bounds read
In computer security and programming, an out-of-bounds read[1] is a software anomaly where a program, while reading data from a buffer, reads outside of the buffer's boundary from adjacent memory. This is a special case of violation of memory safety and is a form of data confidentiality violation (see CIA triad). A buffer over-read[2][3] and buffer under-read are special cases of out-of-bounds reads.[1]
Out-of-bounds reads are the basis of many software vulnerabilities. In some cases, they can be maliciously exploited to access privileged information.[4] For example, they can sometimes be triggered, as in the Heartbleed bug, by maliciously crafted inputs that are designed to exploit a lack of bounds checking to read inaccessible parts of memory.
At other times, out-of-bounds reads can result in other erratic program behavior, including memory access errors (including invalid page faults), incorrect results, or crashes. For example, the widespread IT outages in 2024 were caused by an out-of-bounds memory error in cybersecurity software developed by CrowdStrike.[5]
Programming languages commonly associated with out-of-bounds reads include C and C++, which provide no built-in protection against using pointers to access data in any part of virtual memory, and which do not automatically check that reading data from a block of memory is safe; respective examples are attempting to read more elements than contained in an array, or failing to append a trailing terminator to a null-terminated string.
Bounds checking, sandboxing, static analysis, using memory safe programming languages, and program verification can prevent buffer over-reads,[6] while techniques such as fuzz testing can help detect them.
Examples of out-of-bounds reads
Major historical examples of out-of-bounds reads include:
- Heartbleed (2012) was a major bug in OpenSSL allowing clients to read from arbitrary memory.[7]
- In 2013, a denial-of-service attack was reported in the PHP programming language, caused by a buffer over-read when creating a DateInterval object.[8][9]
- The 2024 CrowdStrike-related IT outages were caused by an out-of-bounds memory read leading to a page fault.[10]
Categorization
Mitre Corporation (MITRE) categorizes out-of-bounds reads under Common Weakness Enumeration CWE-125,[1] with child categories CWE-126 (buffer over-read)[2] and CWE-127 (buffer under-read).[11]
MITRE lists the corresponding attack pattern under Common Attack Pattern Enumeration and Classification "CAPEC-540: Overread Buffers."[12] This attack is listed at a low likelihood of attack, but a high typical severity if an attack does occur.
Mitigation
MITRE recommends that buffer over-reads can be effectively detected with static analysis (more specifically, static application security testing). It recommends dynamic analysis (such as AddressSanitizer) as having moderate effectiveness at detection.[2]
For the parent weakness out-of-bounds reads (CWE-125), MITRE recommends data validation (e.g., check that data is in bounds), as well as language selection: "Use a language that provides appropriate memory abstractions."[1] See also List of programming languages by type. Fuzzing is also listed as a highly effective detection method.[1]
See also
References
- ↑ 1.0 1.1 1.2 1.3 1.4 "CWE - CWE-125: Out-of-bounds Read (4.20)" (in en). https://cwe.mitre.org/data/definitions/125.html.
- ↑ 2.0 2.1 2.2 "CWE – CWE-126: Buffer Over-read". Common Weakness Enumeration (list version 4.15). February 18, 2014. http://cwe.mitre.org/data/definitions/126.html. Retrieved July 24, 2024.
- ↑ Strackx, Raoul; Younan, Yves; Philippaerts, Pieter; Piessens, Frank; Lachmund, Sven; Walter, Thomas (2009-01-01). "Breaking the memory secrecy assumption". Proceedings of the Second European Workshop on System Security. EUROSEC '09. New York, NY, USA: ACM. pp. 1–8. doi:10.1145/1519144.1519145. ISBN 9781605584720. https://lirias.kuleuven.be/handle/123456789/228745.
- ↑ "CWE - CWE-126: Buffer Over-read (4.20)" (in en). https://cwe.mitre.org/data/definitions/126.html.
- ↑ "Falcon Content Update Remediation and Guidance Hub | CrowdStrike" (in en). https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/.
- ↑ "Efficient protection against heap-based buffer overflows without resorting to magic". Dept. of Computer Science, Katholieke Universiteit Leuven. 2013-02-25. http://www.fort-knox.org/files/younan_malloc.pdf. Retrieved 2014-04-24.
- ↑ "OpenSSL 'Heartbleed' vulnerability (CVE-2014-0160) | CISA" (in en). 2016-10-05. https://www.cisa.gov/news-events/alerts/2014/04/08/openssl-heartbleed-vulnerability-cve-2014-0160.
- ↑ "PHP DateInterval Heap Buffer Overread Denial of Service - TELUS Security Labs" (in en-us). http://telussecuritylabs.com/threats/show/TSL20140102-03.
- ↑ "PHP :: Bug #66060 :: Heap buffer over-read in DateInterval". https://bugs.php.net/bug.php?id=66060.
- ↑ "Falcon Content Update Remediation and Guidance Hub" (in en). https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/.
- ↑ "CWE - CWE-127: Buffer Under-read (4.20)" (in en). https://cwe.mitre.org/data/definitions/127.html.
- ↑ "CAPEC - CAPEC-540: Overread Buffers (Version 3.9)". https://capec.mitre.org/data/definitions/540.html.
External links
 |  |
