CWE-125 跨界内存读

Out-of-bounds Read

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown


The software reads data past the end, or before the beginning, of the intended buffer.


Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. A crash can occur when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string. The expected sentinel might not be located in the out-of-bounds memory, causing excessive data to be read, leading to a segmentation fault or a buffer overflow. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent read operation then produces undefined or unexpected results.


  • cwe_Nature: ChildOf cwe_CWE_ID: 119 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 119 cwe_View_ID: 1003 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 119 cwe_View_ID: 699 cwe_Ordinal: Primary


Language: [{'cwe_Name': 'C', 'cwe_Prevalence': 'Undetermined'}, {'cwe_Name': 'C++', 'cwe_Prevalence': 'Undetermined'}]


范围 影响 注释
Confidentiality Read Memory
Confidentiality Bypass Protection Mechanism By reading out-of-bounds memory, an attacker might be able to get secret values, such as memory addresses, which can be bypass protection mechanisms such as ASLR in order to improve the reliability and likelihood of exploiting a separate weakness to achieve code execution instead of just denial of service.


MIT-5 Implementation

策略: Input Validation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a whitelist of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs (i.e., do not rely on a blacklist). A blacklist is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, blacklists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright. To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be espcially careful of relying on a sentinel (i.e. special character such as NUL) in an untrusted inputs.

Architecture and Design

策略: Language Selection

Use a language that provides appropriate memory abstractions.


In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the method

bad C

int getValueFromArray(int *array, int len, int index) {

int value;

// check that the array index is less than the maximum

// length of the array
if (index < len) {

// get the value at the specified index of the array
value = array[index];
// if array index is invalid then output error message

// and return value indicating error
else {
printf("Value is: %d\n", array[index]);
value = -1;

return value;

However, this method only verifies that the given array index is less than the maximum length of the array but does not check for the minimum value (CWE-839). This will allow a negative value to be accepted as the input array index, which will result in a out of bounds read (CWE-125) and may allow access to sensitive memory. The input array index should be checked to verify that is within the maximum and minimum range required for the array (CWE-129). In this example the if statement should be modified to include a minimum range check, as shown below.

good C


// check that the array index is within the correct

// range of values for the array
if (index >= 0 && index < len) {



标识 说明 链接
CVE-2009-2523 Chain: product does not handle when an input string is not NULL terminated (CWE-170), leading to buffer over-read (CWE-125) or heap-based buffer overflow (CWE-122).
CVE-2004-0112 out-of-bounds read due to improper length check
CVE-2004-0183 packet with large number of specified elements cause out-of-bounds read.
CVE-2004-0221 packet with large number of specified elements cause out-of-bounds read.
CVE-2004-0184 out-of-bounds read, resultant from integer underflow
CVE-2004-1940 large length value causes out-of-bounds read
CVE-2004-0421 malformed image causes out-of-bounds read
CVE-2014-0160 Chain: "Heartbleed" bug receives an inconsistent length parameter (CWE-130) enabling an out-of-bounds read (CWE-126), returning memory that could include private cryptographic keys and other sensitive data.



映射的分类名 ImNode ID Fit Mapped Node Name
PLOVER Out-of-bounds Read
Software Fault Patterns SFP8 Faulty Buffer Access
CERT C Secure Coding ARR30-C Imprecise Do not form or use out-of-bounds pointers or array subscripts
CERT C Secure Coding ARR38-C Imprecise Guarantee that library functions do not form invalid pointers
CERT C Secure Coding EXP39-C Imprecise Do not access a variable through a pointer of an incompatible type
CERT C Secure Coding STR31-C Imprecise Guarantee that storage for strings has sufficient space for character data and the null terminator
CERT C Secure Coding STR32-C CWE More Abstract Do not pass a non-null-terminated character sequence to a library function that expects a string


  • CAPEC-537
  • CAPEC-540