|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
CWE-789: Uncontrolled Memory Allocation
 DescriptionDescription Summary The product allocates memory based on an untrusted size value, but it does not validate or incorrectly validates the size, allowing arbitrary amounts of memory to be allocated.
Time of Introduction
Applicable PlatformsLanguages C C++ All Platform Notes Uncontrolled memory allocation is possible in many languages, such as dynamic array allocation in perl or initial size parameters in Collections in Java. However, languages like C and C++ where programmers have the power to more directly control memory management will be more susceptible. Common Consequences
Likelihood of ExploitLow Demonstrative ExamplesExample 1 Consider the following code, which accepts an untrusted size value and allocates a buffer to contain a string of the given size. (Bad Code) unsigned int size = GetUntrustedInt(); /* ignore integer overflow (CWE-190) for this example
*/ unsigned int totBytes = size * sizeof(char); char *string = (char *)malloc(totBytes); InitializeString(string); Suppose an attacker provides a size value of: 12345678 This will cause 305,419,896 bytes (over 291 megabytes) to be allocated for the string. Example 2 Consider the following code, which accepts an untrusted size value and uses the size as an initial capacity for a HashMap. (Bad Code) unsigned int size = GetUntrustedInt(); HashMap list = new HashMap(size); The HashMap constructor will verify that the initial capacity is not negative, however there is no check in place to verify that sufficient memory is present. If the attacker provides a large enough value, the application will run into an OutOfMemoryError. Example 3 The following code obtains an untrusted number that it used as an index into an array of messages. (Bad Code) Example
Language: Perl my $num = GetUntrustedNumber(); my @messages = (); $messages[$num] = "Hello World"; The index is not validated at all (CWE-129), so it might be possible for an attacker to modify an element in @messages that was not intended. If an index is used that is larger than the current size of the array, the Perl interpreter automatically expands the array so that the large index works. If $num is a large value such as 2147483648 (1<<31), then the assignment to $messages[$num] would attempt to create a very large array, then eventually produce an error message such as: Out of memory during array extend This memory exhaustion will cause the Perl program to exit, possibly a denial of service. In addition, the lack of memory could also prevent many other programs from successfully running on the system. Observed Examples
Potential Mitigations
Weakness Ordinalities
Relationships
Relationship Notes
Taxonomy Mappings
References
Content History
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Page Last Updated:
February 20, 2013
|
|
CWE is co-sponsored by the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. This Web site is sponsored and managed by The MITRE Corporation to enable stakeholder collaboration. Copyright © 2006-2013, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information. |
|
|