Stack-based Buffer Overflow

Description

Stack-based Buffer Overflow is a variant of buffer overflow that occurs when a buffer allocated on the stack is overwritten with data larger than its allocated size. The stack stores local variables, function parameters, and return addresses. When a stack buffer overflows, it can overwrite adjacent stack data including saved return addresses and frame pointers. This enables attackers to hijack program execution by redirecting the return address to attacker-controlled code or ROP gadgets. Stack overflows are particularly dangerous because the stack's predictable structure makes exploitation more reliable than heap-based attacks.

Risk

Stack-based buffer overflows are among the most exploitable vulnerability types. The stack's LIFO (Last In, First Out) structure means that return addresses are stored predictably relative to local buffers. Attackers can precisely calculate overflow distances to overwrite return addresses with addresses of injected shellcode or ROP chains. While modern protections (ASLR, stack canaries, DEP) make exploitation harder, bypasses exist and many systems lack full protection. Embedded systems, legacy applications, and kernel code remain highly vulnerable. Successful exploitation grants arbitrary code execution with the process's privileges.

Solution

Use safe string and memory handling functions with explicit size parameters. Enable compiler protections: stack canaries (-fstack-protector-all), ASLR, DEP/NX, and CFI. Use memory-safe languages (Rust, Go) or C++ containers for new development. Employ static analysis (Coverity, CodeQL) and dynamic analysis (ASan, fuzzing) during development. Validate all input sizes before buffer operations. Consider using compiler hardening flags: -D_FORTIFY_SOURCE=2, -fPIE, -Wl,-z,relro,-z,now. For legacy code, audit all uses of dangerous functions like strcpy, gets, sprintf, and scanf with %s.

Common Consequences

Impact	Details
Access Control	Scope: Code Execution Overwriting return addresses enables arbitrary code execution, typically with full privileges of the vulnerable process.
Availability	Scope: Availability Stack corruption commonly causes crashes and denial of service even when exploitation fails.
Integrity	Scope: Integrity Attackers can modify local variables and function parameters to alter program behavior.

Example Code + Solution Code

Vulnerable Code

#include <string.h>

// VULNERABLE: Stack buffer overflow
void process_input(char *user_input) {
    char buffer[64];           // Stack-allocated buffer
    char admin_flag = 0;       // Adjacent variable on stack

    strcpy(buffer, user_input); // Overflow overwrites admin_flag and return address

    if (admin_flag) {
        grant_admin_access();   // Attacker can trigger this
    }
}

// Stack layout (simplified):
// [buffer 64 bytes][admin_flag][saved EBP][return address]
// Overflow can overwrite admin_flag and return address

Fixed Code

#include <string.h>
#include <stdio.h>

// SAFE: Bounds-checked copy
void process_input(const char *user_input) {
    char buffer[64];
    int admin_flag = 0;  // Separate from buffer

    // Use safe copy with explicit size limit
    size_t input_len = strlen(user_input);
    if (input_len >= sizeof(buffer)) {
        fprintf(stderr, "Input too long\n");
        return;
    }

    strncpy(buffer, user_input, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';

    // Admin check should use proper authentication
    // not stack-adjacent variables
}

// Compile with: gcc -fstack-protector-all -D_FORTIFY_SOURCE=2 -pie -fPIE

---

Exploited in the Wild

Sudo Baron Samedit (Linux Systems, 2021)

CVE-2021-3156 was a heap-based overflow in sudo that also affected stack memory, allowing local privilege escalation to root on most Linux distributions. The vulnerability existed for nearly 10 years before discovery.

• https://blog.qualys.com/vulnerabilities-threat-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit

Windows RPC DCOM Vulnerability (Windows, 2003)

MS03-026 was a stack buffer overflow in Windows RPC DCOM interface exploited by the Blaster worm. The worm infected millions of Windows systems and caused widespread internet disruption.

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-026

---

Tools to test/exploit

• GDB + PEDA/GEF — debugger extensions for exploit development and stack analysis.

• ROPgadget — tool for finding ROP gadgets to bypass DEP protection.

• pwntools — exploit development framework with stack overflow utilities.

---

CVE Examples

• CVE-2021-3156 — Sudo heap/stack overflow enabling local root privilege escalation.

• CVE-2003-0352 — Windows RPC DCOM stack overflow exploited by Blaster worm.

---

References

1. MITRE. "CWE-121: Stack-based Buffer Overflow." https://cwe.mitre.org/data/definitions/121.html

2. CERT. "STR31-C. Guarantee that storage for strings has sufficient space." https://wiki.sei.cmu.edu/confluence/display/c/STR31-C