CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11292 vulnerabilities reference this CWE, most recent first.
GHSA-H68Q-3G2M-9W2F
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-07-14 21:31In the Linux kernel, the following vulnerability has been resolved:
ima_fs: Correctly create securityfs files for unsupported hash algos
ima_tpm_chip->allocated_banks[i].crypto_id is initialized to HASH_ALGO__LAST if the TPM algorithm is not supported. However there are places relying on the algorithm to be valid because it is accessed by hash_algo_name[].
On 6.12.40 I observe the following read out-of-bounds in hash_algo_name: ================================================================== BUG: KASAN: global-out-of-bounds in create_securityfs_measurement_lists+0x396/0x440 Read of size 8 at addr ffffffff83e18138 by task swapper/0/1
CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.40 #3 Call Trace: dump_stack_lvl+0x61/0x90 print_report+0xc4/0x580 ? kasan_addr_to_slab+0x26/0x80 ? create_securityfs_measurement_lists+0x396/0x440 kasan_report+0xc2/0x100 ? create_securityfs_measurement_lists+0x396/0x440 create_securityfs_measurement_lists+0x396/0x440 ima_fs_init+0xa3/0x300 ima_init+0x7d/0xd0 init_ima+0x28/0x100 do_one_initcall+0xa6/0x3e0 kernel_init_freeable+0x455/0x740 kernel_init+0x24/0x1d0 ret_from_fork+0x38/0x80 ret_from_fork_asm+0x11/0x20
The buggy address belongs to the variable: hash_algo_name+0xb8/0x420
Memory state around the buggy address: ffffffff83e18000: 00 01 f9 f9 f9 f9 f9 f9 00 01 f9 f9 f9 f9 f9 f9 ffffffff83e18080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffff83e18100: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 05 f9 f9 ^ ffffffff83e18180: f9 f9 f9 f9 00 00 00 00 00 00 00 04 f9 f9 f9 f9 ffffffff83e18200: 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9 ==================================================================
Seems like the TPM chip supports sha3_256, which isn't yet in tpm_algorithms: tpm tpm0: TPM with unsupported bank algorithm 0x0027
That's TPM_ALG_SHA3_256 == 0x0027 from "Trusted Platform Module 2.0 Library Part 2: Structures", page 51 1. See also the related U-Boot algorithms update 2.
Thus solve the problem by creating a file name with "tpm_alg" postfix if the crypto algorithm isn't initialized.
This is how it looks on the test machine (patch ported to v6.12 release): # ls -1 /sys/kernel/security/ima/ ascii_runtime_measurements ascii_runtime_measurements_tpm_alg_27 ascii_runtime_measurements_sha1 ascii_runtime_measurements_sha256 binary_runtime_measurements binary_runtime_measurements_tpm_alg_27 binary_runtime_measurements_sha1 binary_runtime_measurements_sha256 policy runtime_measurements_count violations
{
"affected": [],
"aliases": [
"CVE-2026-53038"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:15Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nima_fs: Correctly create securityfs files for unsupported hash algos\n\nima_tpm_chip-\u003eallocated_banks[i].crypto_id is initialized to\nHASH_ALGO__LAST if the TPM algorithm is not supported. However there\nare places relying on the algorithm to be valid because it is accessed\nby hash_algo_name[].\n\nOn 6.12.40 I observe the following read out-of-bounds in hash_algo_name:\n ==================================================================\n BUG: KASAN: global-out-of-bounds in create_securityfs_measurement_lists+0x396/0x440\n Read of size 8 at addr ffffffff83e18138 by task swapper/0/1\n\n CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.40 #3\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x61/0x90\n print_report+0xc4/0x580\n ? kasan_addr_to_slab+0x26/0x80\n ? create_securityfs_measurement_lists+0x396/0x440\n kasan_report+0xc2/0x100\n ? create_securityfs_measurement_lists+0x396/0x440\n create_securityfs_measurement_lists+0x396/0x440\n ima_fs_init+0xa3/0x300\n ima_init+0x7d/0xd0\n init_ima+0x28/0x100\n do_one_initcall+0xa6/0x3e0\n kernel_init_freeable+0x455/0x740\n kernel_init+0x24/0x1d0\n ret_from_fork+0x38/0x80\n ret_from_fork_asm+0x11/0x20\n \u003c/TASK\u003e\n\n The buggy address belongs to the variable:\n hash_algo_name+0xb8/0x420\n\n Memory state around the buggy address:\n ffffffff83e18000: 00 01 f9 f9 f9 f9 f9 f9 00 01 f9 f9 f9 f9 f9 f9\n ffffffff83e18080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u003effffffff83e18100: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 05 f9 f9\n ^\n ffffffff83e18180: f9 f9 f9 f9 00 00 00 00 00 00 00 04 f9 f9 f9 f9\n ffffffff83e18200: 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9\n ==================================================================\n\nSeems like the TPM chip supports sha3_256, which isn\u0027t yet in\ntpm_algorithms:\n tpm tpm0: TPM with unsupported bank algorithm 0x0027\n\nThat\u0027s TPM_ALG_SHA3_256 == 0x0027 from \"Trusted Platform Module 2.0\nLibrary Part 2: Structures\", page 51 [1].\nSee also the related U-Boot algorithms update [2].\n\nThus solve the problem by creating a file name with \"_tpm_alg_\u003cID\u003e\"\npostfix if the crypto algorithm isn\u0027t initialized.\n\nThis is how it looks on the test machine (patch ported to v6.12 release):\n # ls -1 /sys/kernel/security/ima/\n ascii_runtime_measurements\n ascii_runtime_measurements_tpm_alg_27\n ascii_runtime_measurements_sha1\n ascii_runtime_measurements_sha256\n binary_runtime_measurements\n binary_runtime_measurements_tpm_alg_27\n binary_runtime_measurements_sha1\n binary_runtime_measurements_sha256\n policy\n runtime_measurements_count\n violations\n\n[1]: https://trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-2.0-Library-Part-2-Version-184_pub.pdf\n[2]: https://lists.denx.de/pipermail/u-boot/2024-July/558835.html",
"id": "GHSA-h68q-3g2m-9w2f",
"modified": "2026-07-14T21:31:29Z",
"published": "2026-06-24T18:32:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53038"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/081b557cb56e1cfa8d1619b2601b01c53e3f418c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88d4e89a39f0de07798ca3fd93bd1a9ea212a82e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b6766b171a5c4c33b26ff6fec530cb798db1f75e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d7bd8cf0b348d3edae7bee33e74a32b21668b181"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H69R-4PJW-G22Q
Vulnerability from github – Published: 2022-05-14 01:09 – Updated: 2025-04-20 03:41psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c.
{
"affected": [],
"aliases": [
"CVE-2017-11714"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-28T05:29:00Z",
"severity": "HIGH"
},
"details": "psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c.",
"id": "GHSA-h69r-4pjw-g22q",
"modified": "2025-04-20T03:41:35Z",
"published": "2022-05-14T01:09:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11714"
},
{
"type": "WEB",
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=698158"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201811-12"
},
{
"type": "WEB",
"url": "http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=671fd59eb657743aa86fbc1895cb15872a317caa"
},
{
"type": "WEB",
"url": "http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=671fd59eb657743aa86fbc1895cb15872a317caa"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3986"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039233"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H69R-VW7V-6C65
Vulnerability from github – Published: 2026-05-14 21:30 – Updated: 2026-05-15 00:30Out of bounds read in FileSystem in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-8543"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-14T20:17:15Z",
"severity": "MODERATE"
},
"details": "Out of bounds read in FileSystem in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)",
"id": "GHSA-h69r-vw7v-6c65",
"modified": "2026-05-15T00:30:29Z",
"published": "2026-05-14T21:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8543"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/497095799"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H69V-272R-667V
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-05-24 17:30SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Jupiter Tessallation(.jt) file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
{
"affected": [],
"aliases": [
"CVE-2020-6374"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-15T02:15:00Z",
"severity": "HIGH"
},
"details": "SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated Jupiter Tessallation(.jt) file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.",
"id": "GHSA-h69v-272r-667v",
"modified": "2022-05-24T17:30:47Z",
"published": "2022-05-24T17:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6374"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2973497"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1266"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-H6C4-V2HR-G2V7
Vulnerability from github – Published: 2024-01-18 03:30 – Updated: 2024-01-19 21:30In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
{
"affected": [],
"aliases": [
"CVE-2023-48345"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-18T03:15:57Z",
"severity": "MODERATE"
},
"details": "In video decoder, there is a possible out of bounds read due to improper input validation. This could lead to local denial of service with no additional execution privileges needed",
"id": "GHSA-h6c4-v2hr-g2v7",
"modified": "2024-01-19T21:30:35Z",
"published": "2024-01-18T03:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48345"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1745735200442220545"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H6C8-XHHW-V4MW
Vulnerability from github – Published: 2025-06-10 18:32 – Updated: 2025-06-10 18:32InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2025-47105"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-10T17:23:20Z",
"severity": "MODERATE"
},
"details": "InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-h6c8-xhhw-v4mw",
"modified": "2025-06-10T18:32:29Z",
"published": "2025-06-10T18:32:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47105"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/indesign/apsb25-53.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H6CR-RCVX-H943
Vulnerability from github – Published: 2022-05-14 03:01 – Updated: 2022-05-14 03:01** DISPUTED ** The libfsntfs_mft_entry_read_header function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.
{
"affected": [],
"aliases": [
"CVE-2018-11729"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-200"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-19T21:29:00Z",
"severity": "MODERATE"
},
"details": "** DISPUTED ** The libfsntfs_mft_entry_read_header function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.",
"id": "GHSA-h6cr-rcvx-h943",
"modified": "2022-05-14T03:01:56Z",
"published": "2022-05-14T03:01:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11729"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2018/Jun/17"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H6GC-RMV2-74G6
Vulnerability from github – Published: 2026-06-25 18:30 – Updated: 2026-06-26 18:33Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS.
{
"affected": [],
"aliases": [
"CVE-2026-6094"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T18:16:41Z",
"severity": "MODERATE"
},
"details": "Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS.",
"id": "GHSA-h6gc-rmv2-74g6",
"modified": "2026-06-26T18:33:49Z",
"published": "2026-06-25T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6094"
},
{
"type": "WEB",
"url": "https://github.com/wolfSSL/wolfssl/pull/10128"
},
{
"type": "WEB",
"url": "https://www.wolfssl.com/docs/security-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-H6HR-HG47-9C5P
Vulnerability from github – Published: 2022-05-14 03:14 – Updated: 2022-05-14 03:14An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function raw_read in tsk/img/raw.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.
{
"affected": [],
"aliases": [
"CVE-2018-11739"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-05T11:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function raw_read in tsk/img/raw.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.",
"id": "GHSA-h6hr-hg47-9c5p",
"modified": "2022-05-14T03:14:21Z",
"published": "2022-05-14T03:14:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11739"
},
{
"type": "WEB",
"url": "https://github.com/sleuthkit/sleuthkit/issues/1267"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H6WV-V27F-F93R
Vulnerability from github – Published: 2022-11-07 12:00 – Updated: 2025-05-02 21:30In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. (WOLFSSL_CALLBACKS is only intended for debugging.)
{
"affected": [],
"aliases": [
"CVE-2022-42905"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-07T00:15:00Z",
"severity": "CRITICAL"
},
"details": "In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. (WOLFSSL_CALLBACKS is only intended for debugging.)",
"id": "GHSA-h6wv-v27f-f93r",
"modified": "2025-05-02T21:30:38Z",
"published": "2022-11-07T12:00:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42905"
},
{
"type": "WEB",
"url": "https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh"
},
{
"type": "WEB",
"url": "https://github.com/wolfSSL/wolfssl/releases"
},
{
"type": "WEB",
"url": "https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.2-stable"
},
{
"type": "WEB",
"url": "https://www.wolfssl.com/docs/security-vulnerabilities"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/170610/wolfSSL-WOLFSSL_CALLBACKS-Heap-Buffer-Over-Read.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2023/Jan/11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.