Common Weakness Enumeration
A community-developed list of SW & HW weaknesses that
can become vulnerabilities
Home About ▼ CWE List ▼ Mapping ▼ Top-N Lists ▼ Community ▼ News ▼ Search
CWE-124: Buffer Underwrite ('Buffer Underflow')
Weakness ID: 124
Vulnerability Mapping: ALLOWED
Abstraction: Base
Mapping
View customized information: Conceptual Operational Complete Custom
Friendly
Description
The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
Extended Description
This typically occurs when a pointer or its index is decremented to a position before the buffer, when pointer arithmetic results
in a position before the beginning of the valid memory location, or when a negative index is used.
Alternate Terms
buffer underrun: Some prominent vendors and researchers use the term "buffer underrun". "Buffer underflow" is
more commonly used, although both terms are also sometimes used to describe a buffer under-
read (CWE-127).
Relationships
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name
ChildOf 787 Out-of-bounds Write
ChildOf 786 Access of Memory Location Before Start of Buffer
CanFollow 839 Numeric Range Comparison Without Minimum Check
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name
MemberOf 1218 Memory Buffer Errors
Modes Of Introduction
Phase Note
Implementation
Applicable Platforms
Languages
C (Undetermined Prevalence)
C++ (Undetermined Prevalence)
Demonstrative Examples
Example 1
In the following C/C++ example, a utility function is used to trim trailing whitespace from a character string. The function
copies the input string to a local character string and uses a while statement to remove the trailing whitespace by moving
backward through the string and overwriting whitespace with a NUL character.
Example Language: C (bad code)
char* trimTrailingWhitespace(char *strMessage, int length) {
char *retMessage;
char *message = malloc(sizeof(char)*(length+1));
// copy input string to a temporary string
char message[length+1];
int index;
for (index = 0; index < length; index++) {
message[index] = strMessage[index];
}
message[index] = '\0';
// trim trailing whitespace
int len = index-1;
while (isspace(message[len])) {
message[len] = '\0';
len--;
}
// return string without trailing whitespace
tM
retMessage = message;
return retMessage;
}
However, this function can cause a buffer underwrite if the input character string contains all whitespace. On some systems
the while statement will move backwards past the beginning of a character string and will call the isspace() function on an
address outside of the bounds of the local buffer.
Example 2
The following is an example of code that may result in a buffer underwrite. This code is attempting to replace the substring
"Replace Me" in destBuf with the string stored in srcBuf. It does so by using the function strstr(), which returns a pointer to the
found substring in destBuf. Using pointer arithmetic, the starting index of the substring is found.
Example Language: C (bad code)
int main() {
...
char *result = strstr(destBuf, "Replace Me");
int idx = result - destBuf;
strcpy(&destBuf[idx], srcBuf);
...
}
In the case where the substring is not found in destBuf, strstr() will return NULL, causing the pointer arithmetic to be undefined,
potentially setting the value of idx to a negative number. If idx is negative, this will result in a buffer underwrite of destBuf.
Observed Examples
Reference Description
CVE-2021-24018 buffer underwrite in firmware verification routine allows code execution via a crafted
firmware image
CVE-2002-2227 Unchecked length of SSLv2 challenge value leads to buffer underflow.
CVE-2007-4580 Buffer underflow from a small size value with a large buffer (length parameter
inconsistency, CWE-130)
CVE-2007-1584 Buffer underflow from an all-whitespace string, which causes a counter to be
decremented before the buffer while looking for a non-whitespace character.
CVE-2007-0886 Buffer underflow resultant from encoded data that triggers an integer overflow.
CVE-2006-6171 Product sets an incorrect buffer size limit, leading to "off-by-two" buffer underflow.
CVE-2006-4024 Negative value is used in a memcpy() operation, leading to buffer underflow.
CVE-2004-2620 Buffer underflow due to mishandled special characters
Potential Mitigations
Phase: Requirements
Choose a language that is not susceptible to these issues.
Phase: Implementation
All calculated values that are used as index or for pointer arithmetic should be validated to ensure that they are
within an expected range.
Memberships
Nature Type ID Name
MemberOf 970 SFP Secondary Cluster: Faulty Buffer Access
MemberOf 1399 Comprehensive Categorization: Memory Safety
Vulnerability Mapping Notes
Usage: ALLOWED (this CWE ID could be used to map to real-world vulnerabilities)
Reason: Acceptable-Use
Rationale:
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes
of vulnerabilities.
Comments:
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a
mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Content History
Submissions
Submission Date Submitter Organization
2006-07-19 PLOVER
(CWE Draft 3, 2006-07-19)
Contributions
Contribution Date Contributor Organization
2023-02-06 Muchen Xu Naive Systems
Submissions
Pointed out that the demonstrative example #2 was incorrect and instead demonstrated a Buffer
Under-read.
Modifications
Previous Entry Names
