What is Out-of-bounds Write (CWE-787)?

TL;DR: Out-of-bounds Write (CWE-787) is a critical vulnerability where data exceeds buffer boundaries, causing memory corruption. Proper bounds checking and secure language choices mitigate this risk.

What is Out-of-bounds Write?

Out-of-bounds Write (CWE-787) is a type of memory corruption vulnerability where data is written past the intended buffer boundaries. As defined by the MITRE Corporation under CWE-787, and classified by the OWASP Foundation under no direct mapping…

Quick Summary

Out-of-bounds Write vulnerabilities occur when a program writes data outside allocated buffers, leading to potential crashes or unauthorized code execution. This can compromise system integrity and availability. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixing · Framework Fixes · AI Prompt · Checklist · FAQ

Jump to: Quick Summary · Out-of-bounds Write Overview · How Out-of-bounds Write Works · Business Impact of Out-of-bounds Write · Out-of-bounds Write Attack Scenario · How to Detect Out-of-bounds Write · How to Fix Out-of-bounds Write · Framework-Specific Fixes for Out-of-bounds Write · How to Ask AI to Check Your Code for Out-of-bounds Write · Out-of-bounds Write Best Practices Checklist · Out-of-bounds Write FAQ · Vulnerabilities Related to Out-of-bounds Write · References · Scan Your Own Site

Out-of-bounds Write Overview

What

Out-of-bounds Write is a memory corruption issue where data exceeds buffer boundaries, leading to undefined behavior and potential security vulnerabilities.

Why it matters

This vulnerability can lead to unauthorized code execution, crashes due to invalid memory access, or unexpected application states that compromise system integrity.

Where it occurs

It commonly affects low-level languages like C/C++ but can also impact higher-level languages if improper buffer handling is employed.

Who is affected

Developers using memory-managed languages without proper safety measures are at risk. Systems with unbounded data copying operations are particularly vulnerable.

Who is NOT affected

Applications that strictly enforce bounds checking and use memory-safe programming practices (like Rust, Go) are less susceptible to this issue.

How Out-of-bounds Write Works

Root Cause

The root cause of out-of-bounds write vulnerabilities lies in the lack of proper boundary checks when writing data into buffers. This can lead to overwriting adjacent memory locations with unintended values.

Attack Flow

1. An attacker identifies a buffer that is susceptible to overflow.
2. The attacker crafts input that causes the program to exceed the buffer’s boundaries during write operations.
3. The overflowed data may overwrite critical control structures, such as return addresses or function pointers.
4. This can lead to arbitrary code execution if an attacker can manipulate these structures.

Prerequisites to Exploit

• A buffer with insufficient boundary checks.
• Input that exceeds the expected buffer size and triggers a write operation beyond its bounds.

Vulnerable Code

void unsafe_write(char *buffer, int len) {
    char dest[10];
    memcpy(dest, buffer, len); // No length check before copying
}

This code is vulnerable because it performs an unbounded copy without checking the length of buffer, leading to potential overflows.

Secure Code

void safe_write(char *buffer, int len) {
    char dest[10];
    if (len > sizeof(dest)) return; // Ensure buffer size does not exceed destination
    memcpy(dest, buffer, len); 
}

The secure version includes a check to ensure the input length does not exceed the allocated buffer size.

Business Impact of Out-of-bounds Write

Integrity

• Data Corruption: Overwritten data can lead to incorrect application states and corrupted databases.
• Unexpected Behavior: Applications may behave unpredictably due to overwritten control structures, leading to crashes or unauthorized actions.

Availability

• Crashes: Unchecked writes can cause the program to crash when it attempts to access invalid memory addresses.
• DoS Attacks: Exploiting out-of-bounds write vulnerabilities can be used to intentionally disrupt service availability.

Financial

• Reputation Damage: Security breaches due to out-of-bounds write vulnerabilities can harm a company’s reputation and customer trust.
• Compliance Fines: Non-compliance with security standards may result in legal penalties and fines.

Out-of-bounds Write Attack Scenario

1. An attacker identifies an unbounded copy operation in the software.
2. The attacker crafts input that exceeds the buffer size, triggering a write beyond its boundaries.
3. This overwrites adjacent memory locations, potentially altering control structures like return addresses or function pointers.
4. By manipulating these structures, the attacker can execute arbitrary code on the system.

How to Detect Out-of-bounds Write

Manual Testing

• Review buffer handling functions for proper bounds checking.
• Verify that all data copying operations have length checks before performing writes.
• Test edge cases where input lengths approach or exceed buffer sizes.

Automated Scanners (SAST / DAST)

Static analysis can detect unbounded copy operations and missing boundary checks. Dynamic testing is needed to verify actual runtime behavior under various inputs.

PenScan Detection

PenScan’s engines such as ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap include rules for identifying out-of-bounds write vulnerabilities.

False Positive Guidance

False positives often arise from benign operations that do not actually lead to memory corruption. Ensure the context indicates actual risk before flagging as a vulnerability.

How to Fix Out-of-bounds Write

• Implement strict bounds checking on all buffer writes.
• Use safer programming languages or libraries that prevent such issues by design.
• Employ static code analysis tools to catch potential vulnerabilities early in development.
• Validate input lengths and enforce maximum buffer sizes before performing any data copying operations.

Framework-Specific Fixes for Out-of-bounds Write

C/C++

void safe_write(char *buffer, int len) {
    char dest[10];
    if (len > sizeof(dest)) return;
    memcpy(dest, buffer, len);
}

This example ensures that the input length does not exceed the destination buffer size before performing a copy operation.

How to Ask AI to Check Your Code for Out-of-bounds Write

Out-of-bounds Write Best Practices Checklist

✅ Implement strict bounds checking on all data copying operations. ✅ Use safer programming languages or libraries that prevent out-of-bounds writes by design. ✅ Employ static code analysis tools to catch potential vulnerabilities early in development. ✅ Validate input lengths and enforce maximum buffer sizes before performing any data manipulation. ✅ Test edge cases where input lengths approach or exceed buffer sizes during manual testing.

Out-of-bounds Write FAQ

How does out-of-bounds write occur in code?

Out-of-bounds writes happen when a program attempts to write data past the end of an allocated buffer, leading to memory corruption and potential exploitation.

What are common consequences of out-of-bounds write vulnerabilities?

These include unauthorized execution of code, crashes due to invalid memory access, and unexpected application states that can compromise system integrity.

Can you provide a real-world example of an out-of-bounds write attack?

An attacker could exploit buffer overflows in software like Apache or PHP to execute arbitrary commands on the server by injecting malicious input that triggers an out-of-bounds write.

What is a manual testing checklist for finding out-of-bounds writes?

Review buffer handling, ensure proper bounds checking, and validate memory operations to prevent overwriting adjacent data structures.

Which languages are most susceptible to out-of-bounds write vulnerabilities?

C/C++ programs are particularly vulnerable due to low-level memory management, but other languages like Python can also suffer from similar issues if not handled properly.

How do you fix an out-of-bounds write vulnerability in Java?

Use safe string handling methods and ensure proper bounds checking when manipulating arrays or buffers.

What are best practices to prevent out-of-bounds writes during development?

Employ static code analysis tools, use memory-safe languages where possible, and conduct thorough security reviews of critical sections.

Vulnerabilities Related to Out-of-bounds Write

| CWE | Name | Relationship | |—|—|—| | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | ChildOf |

References

• MITRE
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Out-of-bounds Write and other risks before an attacker does.