Assignment of a Fixed Address to a Pointer

Opis

The product sets a pointer to a specific address other than NULL or 0.

Using a fixed address is not portable, because that address will probably not be valid in all environments or platforms.

Skutki

• Integrity, Confidentiality, Availability

  Execute Unauthorized Code or Commands

  If one executes code at a known location, an attacker might be able to inject code there beforehand.

• Availability

  DoS: Crash, Exit, or Restart; Reduce Maintainability; Reduce Reliability

  If the code is ported to another platform or environment, the pointer is likely to be invalid and cause a crash.

• Confidentiality, Integrity

  Read Memory; Modify Memory

  The data at a known pointer location can be easily read or influenced by an attacker.

Zapobieganie

• Implementation

  Never set a pointer to a fixed address.

Słabość nadrzędna

• CWE-344 Use of Invariant Value in Dynamically Changing Context
• CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Kiedy powstaje

• Implementation

Dotyczy

Memory-Unsafe, C, C++, C#, Assembly

Źródła

1. AddressSanitizer