CWE-121
AllowedStack-based Buffer Overflow
Abstraction: Variant · Status: Draft
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
5810 vulnerabilities reference this CWE, most recent first.
GHSA-7F92-XQQR-XJHW
Vulnerability from github – Published: 2025-03-20 15:30 – Updated: 2025-03-24 15:30Tenda AC8V4.0 V16.03.34.06 was discovered to contain a stack overflow via the deviceid parameter in the get_parentControl_list_Info function.
{
"affected": [],
"aliases": [
"CVE-2025-29101"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T13:15:36Z",
"severity": "HIGH"
},
"details": "Tenda AC8V4.0 V16.03.34.06 was discovered to contain a stack overflow via the deviceid parameter in the get_parentControl_list_Info function.",
"id": "GHSA-7f92-xqqr-xjhw",
"modified": "2025-03-24T15:30:39Z",
"published": "2025-03-20T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29101"
},
{
"type": "WEB",
"url": "https://github.com/Raining-101/IOT_cve/blob/main/tenda-ac8_get_parentControl_list_Info_overflow.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7F9J-8MJP-QV5P
Vulnerability from github – Published: 2026-06-02 15:32 – Updated: 2026-06-03 15:30A stack-based buffer overflow in the export_language.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request to the /cgi-bin/admin/export_language.cgi endpoint. The handler passes the attacker-controlled Content-Length value directly to fread() as the read size into a fixed-size 0x60-byte stack buffer, overwriting the saved link register. The binary is compiled without stack canaries.
{
"affected": [],
"aliases": [
"CVE-2026-35717"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-02T14:16:51Z",
"severity": "MODERATE"
},
"details": "A stack-based buffer overflow in the export_language.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request to the /cgi-bin/admin/export_language.cgi endpoint. The handler passes the attacker-controlled Content-Length value directly to fread() as the read size into a fixed-size 0x60-byte stack buffer, overwriting the saved link register. The binary is compiled without stack canaries.",
"id": "GHSA-7f9j-8mjp-qv5p",
"modified": "2026-06-03T15:30:39Z",
"published": "2026-06-02T15:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35717"
},
{
"type": "WEB",
"url": "https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-35717"
},
{
"type": "WEB",
"url": "http://vivotek.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7FM7-H87X-9HJQ
Vulnerability from github – Published: 2026-06-17 18:35 – Updated: 2026-06-17 18:35A stack-based buffer overflow exists in the raw_to_header() function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy() without guaranteeing null termination of the source. The POSIX ustar format permits these fixed-width fields to be fully populated with non-null bytes, so a crafted archive whose linkname field (followed by the trailing padding of the 512-byte raw header) contains no null terminator causes strcpy() to read past the end of the 512-byte raw header stack buffer and to write past the destination header buffer. A remote attacker who supplies a crafted TAR archive that the victim opens or parses (via mtar_open(), mtar_read_header(), or mtar_find()) can cause an out-of-bounds read and a stack buffer overflow, resulting in denial of service (crash) and potentially arbitrary code execution. Confirmed with AddressSanitizer: stack-buffer-overflow READ of size 356 in raw_to_header at src/microtar.c:112.
{
"affected": [],
"aliases": [
"CVE-2026-55738"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-17T14:18:00Z",
"severity": "HIGH"
},
"details": "A stack-based buffer overflow exists in the raw_to_header() function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy() without guaranteeing null termination of the source. The POSIX ustar format permits these fixed-width fields to be fully populated with non-null bytes, so a crafted archive whose linkname field (followed by the trailing padding of the 512-byte raw header) contains no null terminator causes strcpy() to read past the end of the 512-byte raw header stack buffer and to write past the destination header buffer. A remote attacker who supplies a crafted TAR archive that the victim opens or parses (via mtar_open(), mtar_read_header(), or mtar_find()) can cause an out-of-bounds read and a stack buffer overflow, resulting in denial of service (crash) and potentially arbitrary code execution. Confirmed with AddressSanitizer: stack-buffer-overflow READ of size 356 in raw_to_header at src/microtar.c:112.",
"id": "GHSA-7fm7-h87x-9hjq",
"modified": "2026-06-17T18:35:55Z",
"published": "2026-06-17T18:35:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55738"
},
{
"type": "WEB",
"url": "https://github.com/rxi/microtar"
},
{
"type": "WEB",
"url": "https://github.com/rxi/microtar/blob/master/src/microtar.c#L111"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/rxi/microtar/master/src/microtar.c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7FVF-PHGC-7GPV
Vulnerability from github – Published: 2025-10-14 12:31 – Updated: 2025-10-14 15:31In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432661; Issue ID: MSV-3904.
{
"affected": [],
"aliases": [
"CVE-2025-20713"
],
"database_specific": {
"cwe_ids": [
"CWE-121",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T10:15:35Z",
"severity": "HIGH"
},
"details": "In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432661; Issue ID: MSV-3904.",
"id": "GHSA-7fvf-phgc-7gpv",
"modified": "2025-10-14T15:31:25Z",
"published": "2025-10-14T12:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20713"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/October-2025"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7FVW-CRPQ-X82C
Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-03 15:32Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.
{
"affected": [],
"aliases": [
"CVE-2026-73600"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T13:06:03Z",
"severity": "HIGH"
},
"details": "Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.",
"id": "GHSA-7fvw-crpq-x82c",
"modified": "2026-09-03T15:32:11Z",
"published": "2026-09-03T15:32:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73600"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000501452/dsa-2026-368-security-update-for-dell-powerprotect-data-manager-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7G7H-586J-X4H5
Vulnerability from github – Published: 2024-01-15 03:30 – Updated: 2025-02-16 09:30A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as critical. This vulnerability affects unknown code of the file /goform/WifiExtraSet of the component Web-based Management Interface. The manipulation of the argument wpapsk_crypto2_4g leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250702 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2024-0532"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-121",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-15T02:15:15Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as critical. This vulnerability affects unknown code of the file /goform/WifiExtraSet of the component Web-based Management Interface. The manipulation of the argument wpapsk_crypto2_4g leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250702 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-7g7h-586j-x4h5",
"modified": "2025-02-16T09:30:24Z",
"published": "2024-01-15T03:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0532"
},
{
"type": "WEB",
"url": "https://github.com/yaoyue123/iot/blob/main/Tenda/A15/WifExtraSet.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.250702"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.250702"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.262690"
},
{
"type": "WEB",
"url": "https://www.tenda.com.cn"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7G8H-978R-MHH2
Vulnerability from github – Published: 2025-01-09 09:31 – Updated: 2025-01-09 15:31A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution.
{
"affected": [],
"aliases": [
"CVE-2024-12803"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T08:15:26Z",
"severity": "CRITICAL"
},
"details": "A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution.",
"id": "GHSA-7g8h-978r-mhh2",
"modified": "2025-01-09T15:31:51Z",
"published": "2025-01-09T09:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12803"
},
{
"type": "WEB",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7G8J-95MJ-P92J
Vulnerability from github – Published: 2025-05-09 06:32 – Updated: 2025-05-09 06:32The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
{
"affected": [],
"aliases": [
"CVE-2025-3711"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-09T04:16:11Z",
"severity": "CRITICAL"
},
"details": "The LCD KVM over IP Switch CL5708IM has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.",
"id": "GHSA-7g8j-95mj-p92j",
"modified": "2025-05-09T06:32:36Z",
"published": "2025-05-09T06:32:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3711"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-10104-63bf4-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-10096-60a81-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7GC7-3GXP-V85M
Vulnerability from github – Published: 2026-08-24 18:31 – Updated: 2026-08-24 18:31Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi. Attackers can exploit the custom Base64 decoder's lack of output length validation against the fixed-size stack buffer to achieve remote code execution with root privileges, as the Boa web server executes the CGI environment as root.
{
"affected": [],
"aliases": [
"CVE-2026-76070"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-24T16:17:22Z",
"severity": "CRITICAL"
},
"details": "Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi. Attackers can exploit the custom Base64 decoder\u0027s lack of output length validation against the fixed-size stack buffer to achieve remote code execution with root privileges, as the Boa web server executes the CGI environment as root.",
"id": "GHSA-7gc7-3gxp-v85m",
"modified": "2026-08-24T18:31:51Z",
"published": "2026-08-24T18:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76070"
},
{
"type": "WEB",
"url": "https://github.com/ozcanpng/CVE-2026-76070"
},
{
"type": "WEB",
"url": "https://ozcanpng.dev/blog/cve-2026-76070-netis-nc63-login-stack-buffer-overflow"
},
{
"type": "WEB",
"url": "https://www.netis-systems.com/products/NC63.html"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/netis-nc63-stack-buffer-overflow-via-login-password-parameter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7GX3-R5Q9-6J33
Vulnerability from github – Published: 2026-06-05 12:31 – Updated: 2026-08-05 00:30A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.
{
"affected": [],
"aliases": [
"CVE-2026-50256"
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-05T12:16:38Z",
"severity": "HIGH"
},
"details": "A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library\u0027s maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2\u0027s alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.",
"id": "GHSA-7gx3-r5q9-6j33",
"modified": "2026-08-05T00:30:33Z",
"published": "2026-06-05T12:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50256"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26562"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:38502"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:38810"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:46377"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:46382"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:46385"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:46392"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:46456"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:46460"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:46473"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:49519"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-50256"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485380"
},
{
"type": "WEB",
"url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/bb5158f962dc935e58ef8b4b5fcb31be201a6e07"
},
{
"type": "WEB",
"url": "https://lists.x.org/archives/xorg-announce/2026-June/003702.html"
},
{
"type": "WEB",
"url": "https://redhat.atlassian.net/browse/PSIRTSUPT-16950"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50256.json"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26566"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26590"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26610"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26709"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:28923"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:29844"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36083"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36085"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36086"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36087"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36632"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36633"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36634"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36768"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36791"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36792"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36798"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-10
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Implement and perform bounds checking on input.
Mitigation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Mitigation MIT-11
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
No CAPEC attack patterns related to this CWE.