Memory Allocation with Excessive Size Value

Opis

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Inne nazwy

Stack Exhaustion

When a weakness allocates excessive memory on the stack, it is often described as "stack exhaustion," which is a technical impact of the weakness. This technical impact is often encountered as a consequence of CWE-789 and/or CWE-1325.

Skutki

• Availability

  DoS: Resource Consumption (Memory)

  Not controlling memory allocation can result in a request for too much system memory, possibly leading to a crash of the application due to out-of-memory conditions, or the consumption of a large amount of memory on the system.

Zapobieganie

• Implementation, Architecture and Design

  Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.

• Operation

  Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.

Przykłady podatności

• CVE-2023-2253 Query capability for API endpoint allows a large value for number of records to return, leading to allocation of a large array
• CVE-2019-19911 Chain: Python library does not limit the resources used to process images that specify a very large number of bands (CWE-1284), leading to excessive memory consumption (CWE-789) or an integer overflow (CWE-190).
• CVE-2010-3701 program uses ::alloca() for encoding messages, but large messages trigger segfault
• CVE-2008-1708 memory consumption and daemon exit by specifying a large value in a length field
• CVE-2008-0977 large value in a length field leads to memory consumption and crash when no more memory is available
• CVE-2006-3791 large key size in game program triggers crash when a resizing function cannot allocate enough memory
• CVE-2004-2589 large Content-Length HTTP header value triggers application crash in instant messaging application due to failure in memory allocation

Słabość nadrzędna

• CWE-770 Allocation of Resources Without Limits or Throttling

Może prowadzić do

• CWE-476 NULL Pointer Dereference

Kiedy powstaje

• Implementation

Dotyczy

C, C++, Not Language-Specific

Uwagi

This weakness can be closely associated with integer overflows (CWE-190). Integer overflow attacks would concentrate on providing an extremely large number that triggers an overflow that causes less memory to be allocated than expected. By providing a large value that does not trigger an integer overflow, the attacker could still cause excessive amounts of memory to be allocated.

Uncontrolled memory allocation is possible in many languages, such as dynamic array allocation in perl or initial size parameters in Collections in Java. However, languages like C and C++ where programmers have the power to more directly control memory management will be more susceptible.

Źródła

1. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 10, "Resource Limits", Page 574, Addison Wesley, 2006
2. Automated Source Code Security Measure (ASCSM) — Object Management Group (OMG), ASCSM-CWE-789, 2016
3. AddressSanitizer