Description
The product reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
Potential Impact
- Confidentiality: Read Memory
- Integrity: Modify Memory
- Integrity: Modify Memory
Detection Methods
- Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with rand...
- Automated Dynamic Analysis: Use tools that are integrated during
compilation to insert runtime error-checking mechanisms
related to memory safety errors, such as AddressSanitizer
(ASan) for C/C++ [REF-1518]....
Related Weaknesses
References
View on MITRE CWE Database →
