What is Return of Stack Variable Address (CWE-562)?

TL;DR: Return of Stack Variable Address (CWE-562) is a vulnerability where returning stack variable addresses causes crashes and exposes memory data. Fix it by avoiding such returns in your functions.

What is Return of Stack Variable Address?

Return of Stack Variable Address (CWE-562) is a type of undefined behavior vulnerability that occurs when a function returns the address of a stack variable. As defined by the MITRE Corporation under CWE-562, and classified by the OWASP Foundation as not directly mapped.

Quick Summary

Return of Stack Variable Address can lead to crashes and expose memory addresses or data, making applications vulnerable to attacks. This vulnerability is particularly critical in C/C++ environments where stack variables are commonly used. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixing · Framework-Specific Fixes · AI Check · Best Practices · FAQ

Jump to: Quick Summary · Return of Stack Variable Address Overview · How Return of Stack Variable Address Works · Business Impact of Return of Stack Variable Address · Return of Stack Variable Address Attack Scenario · How to Detect Return of Stack Variable Address · How to Fix Return of Stack Variable Address · Framework-Specific Fixes for Return of Stack Variable Address · How to Ask AI to Check Your Code for Return of Stack Variable Address · Return of Stack Variable Address Best Practices Checklist · Return of Stack Variable Address FAQ · Vulnerabilities Related to Return of Stack Variable Address · References · Scan Your Own Site

Return of Stack Variable Address Overview

What

Return of Stack Variable Address is a vulnerability where functions return the address of stack variables, leading to unintended program behavior and potential crashes.

Why it matters

This can cause DoS attacks, unauthorized code execution, data leaks, and system instability due to dereferencing invalid addresses.

Where it occurs

It commonly affects C/C++ applications that improperly handle memory addresses.

Who is affected

Developers working on low-level systems programming or embedded software are most at risk.

Who is NOT affected

Applications using high-level languages like Python, Java, and JavaScript, which abstract away stack management.

How Return of Stack Variable Address Works

Root Cause

Returning the address of a stack variable causes undefined behavior because the memory becomes invalid after the function returns.

Attack Flow

1. Function returns a pointer to a local variable.
2. Pointer is dereferenced elsewhere in code, leading to a crash or data exposure.
3. Attacker exploits this by manipulating the program flow to dereference the invalid address.

   Prerequisites to Exploit

   • The returned stack buffer address must be used after function return.
   • Code must dereference the pointer without validation.

     Vulnerable Code

     void getBufferAddress(char* &buffer) {
      char local[10];
      buffer = local;
     }
     

     This code returns a pointer to local, which is invalid once the function exits.

Secure Code

void allocateBuffer(char*& buffer) {
    buffer = new char[10];
}

The secure version allocates memory on the heap, ensuring it remains valid after function return.

Business Impact of Return of Stack Variable Address

• Availability: Potential crashes disrupt service availability.
• Integrity: Unauthorized data modifications can corrupt system integrity.
• Confidentiality: Exposed addresses may reveal sensitive information.

Real-world consequences include financial losses due to downtime, compliance penalties for data breaches, and reputational damage from security incidents.

Return of Stack Variable Address Attack Scenario

1. Attacker identifies a function returning stack variable address.
2. Exploits this by manipulating program flow to dereference the invalid pointer.
3. Causes application crash or unauthorized memory access leading to further exploitation.

How to Detect Return of Stack Variable Address

Manual Testing

• Review functions for return statements that pass addresses of local variables.
• Check if returned pointers are used after function scope ends.
• Ensure proper validation and cleanup before returning stack addresses.

  Automated Scanners (SAST / DAST)

  Static analysis can identify suspicious patterns, while dynamic testing confirms actual exploitation scenarios.

  PenScan Detection

  PenScan’s ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap engines detect potential CWE-562 vulnerabilities.

  False Positive Guidance

  False positives may occur if the returned address is never dereferenced or used after function scope.

How to Fix Return of Stack Variable Address

• Ensure functions do not return addresses of stack variables.
• Use heap allocation for dynamic memory needs.
• Avoid returning pointers to local variables in C/C++ code.

Framework-Specific Fixes for Return of Stack Variable Address

C++

void allocateBuffer(char*& buffer) {
    buffer = new char[10];
}

Secure version allocates memory on the heap, ensuring it remains valid after function return.

How to Ask AI to Check Your Code for Return of Stack Variable Address

Return of Stack Variable Address Best Practices Checklist

✅ Ensure functions do not return addresses of stack variables. ✅ Use dynamic memory allocation (heap) when returning pointers to local data. ✅ Validate and clean up before returning any pointer from a function.

Return of Stack Variable Address FAQ

How does the Return of Stack Variable Address (CWE-562) work?

It occurs when a function returns the address of a stack variable, leading to unintended program behavior and potential crashes or memory exposure.

What are the consequences of CWE-562 in real-world applications?

This weakness can lead to DoS attacks, unauthorized code execution, data leaks, and system instability due to dereferencing invalid addresses.

How do you detect Return of Stack Variable Address vulnerabilities?

Manual testing involves reviewing function returns for stack variable addresses. Automated tools like PenScan help identify such issues during static analysis.

What is the primary fix for CWE-562?

Ensure functions do not return addresses of stack variables by redesigning code to avoid this pattern altogether.

How can developers prevent Return of Stack Variable Address in C++ applications?

Refactor code to use heap allocation or static variables instead of returning stack variable addresses directly from functions.

Can you provide an example of secure code that avoids CWE-562?

Secure code does not return the address of a stack variable, ensuring memory safety and preventing potential crashes or leaks.

What are some common mistakes developers make when addressing CWE-562?

Common errors include attempting to sanitize input rather than redesigning functions to avoid returning stack addresses.

Vulnerabilities Related to Return of Stack Variable Address

| CWE | Name | Relationship | |—|—|—| | CWE-758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior | ChildOf | | CWE-672 | Operation on a Resource after Expiration or Release | CanPrecede | | CWE-825 | Expired Pointer Dereference | CanPrecede |

References

• MITRE CWE-562
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Return of Stack Variable Address and other risks before an attacker does.