Buffer Over-read

Description

Buffer Over-read occurs when a program reads data from memory locations beyond the end of an intended buffer. This happens when array indices, pointer arithmetic, or length parameters exceed the buffer's allocated size without proper validation. Unlike buffer overflows (writes), over-reads primarily expose confidential information rather than enabling direct code execution. However, leaked memory contents can include cryptographic keys, passwords, session tokens, and memory addresses that facilitate exploitation of other vulnerabilities. The Heartbleed vulnerability demonstrated that buffer over-reads can have catastrophic security implications at internet scale.

Risk

Buffer over-reads pose severe confidentiality risks by exposing sensitive data from adjacent memory regions. In cryptographic implementations, they can leak private keys and session secrets. In web servers, they may expose authentication credentials, session tokens, and personal user data across different requests. Memory address disclosure enables ASLR bypass, facilitating subsequent exploitation. The Heartbleed bug (CVE-2014-0160) allowed attackers to read 64KB of server memory per request, affecting an estimated 17% of all SSL-enabled websites and exposing countless private keys and credentials. Bruce Schneier described it as "catastrophic...on a scale of 1 to 10, this is an 11."

Solution

Validate all buffer read operations against allocated buffer sizes. Use length-checked functions and pass actual buffer sizes as parameters. Implement bounds-checking containers (std::vector, std::string in C++). Never trust user-supplied length values without validation against actual data sizes. Use the minimum of claimed length and actual buffer size for copy operations. Enable AddressSanitizer during development. Consider memory-safe languages for security-critical data processing. Apply defense-in-depth by minimizing sensitive data retention in memory.

Common Consequences

Impact	Details
Confidentiality	Scope: Information Disclosure Sensitive data including cryptographic keys, passwords, session tokens, and personal information can be exposed from adjacent memory.
Access Control	Scope: Security Bypass Leaked memory addresses enable ASLR bypass, facilitating exploitation of other vulnerabilities.
Availability	Scope: Availability Reading from unmapped memory regions causes segmentation faults and crashes.

Example Code + Solution Code

Vulnerable Code

#include <string.h>
#include <stdlib.h>

// VULNERABLE: Heartbleed-like over-read
void send_heartbeat(char *payload, size_t claimed_length) {
    char response[65536];

    // Trusts user-supplied length without validation
    // If claimed_length > actual payload, reads adjacent memory
    memcpy(response, payload, claimed_length);

    send_to_client(response, claimed_length);  // Leaks memory
}

// VULNERABLE: Over-read via unchecked index
char get_char_at(char *buffer, int index) {
    // No bounds check - can read beyond buffer
    return buffer[index];
}

// VULNERABLE: String operation over-read
void process_packet(char *packet, size_t packet_len) {
    char type[32];

    // strcpy reads until null terminator
    // If packet not null-terminated, reads beyond packet_len
    strcpy(type, packet);
}

Fixed Code

#include <string.h>
#include <stdlib.h>
#include <stdint.h>

// SAFE: Validate length against actual data
void send_heartbeat_safe(const char *payload, size_t actual_len,
                         size_t claimed_length) {
    char response[65536];

    // Use minimum of claimed and actual length
    size_t copy_len = claimed_length < actual_len ? claimed_length : actual_len;

    // Also check against response buffer size
    if (copy_len > sizeof(response)) {
        copy_len = sizeof(response);
    }

    memcpy(response, payload, copy_len);
    send_to_client(response, copy_len);
}

// SAFE: Bounds-checked buffer access
int get_char_at_safe(const char *buffer, size_t buffer_size,
                     size_t index, char *out_char) {
    if (index >= buffer_size) {
        return -1;  // Error: out of bounds
    }
    *out_char = buffer[index];
    return 0;
}

// SAFE: Length-limited string copy
void process_packet_safe(const char *packet, size_t packet_len) {
    char type[32];

    // Use strncpy with explicit limit
    size_t copy_len = packet_len < sizeof(type) - 1 ? packet_len : sizeof(type) - 1;

    memcpy(type, packet, copy_len);
    type[copy_len] = '\0';  // Ensure null termination
}

---

Exploited in the Wild

Heartbleed (OpenSSL, 2014)

CVE-2014-0160 was a buffer over-read in OpenSSL's TLS heartbeat extension that allowed attackers to read 64KB of server memory per request. The vulnerability affected 17.5% of SSL websites and exposed private keys, session cookies, and user credentials at massive scale. Notable breaches included theft of 900 Canadian Social Insurance Numbers.

• https://heartbleed.com/
• https://owasp.org/www-community/vulnerabilities/Heartbleed_Bug

Cloudbleed (Cloudflare, 2017)

A parser bug in Cloudflare's HTML parser caused buffer over-reads that leaked sensitive data from other customers' requests into cached pages. Leaked data included passwords, API keys, and authentication tokens from millions of websites.

• https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/

CrowdStrike Outage (CrowdStrike, 2024)

Widespread IT outages affecting millions of systems were caused by an out-of-bounds memory read error in CrowdStrike's Falcon sensor software, demonstrating the availability impact of over-read bugs.

• https://www.crowdstrike.com/

---

Tools to test/exploit

• AddressSanitizer — runtime detection of buffer over-reads with detailed error reports.

• Valgrind — detects invalid reads beyond buffer boundaries.

• AFL++ / libFuzzer — fuzzers effective at triggering over-read conditions through malformed input.

---

CVE Examples

• CVE-2014-0160 — Heartbleed: OpenSSL TLS heartbeat buffer over-read.

• CVE-2017-0143 — Windows SMB buffer over-read (part of EternalBlue).

• CVE-2022-0778 — OpenSSL BN_mod_sqrt infinite loop causing over-read conditions.

---

References

1. MITRE. "CWE-126: Buffer Over-read." https://cwe.mitre.org/data/definitions/126.html

2. Heartbleed.com. "The Heartbleed Bug." https://heartbleed.com/

3. Wheeler, David. "How to Prevent the Next Heartbleed." https://dwheeler.com/essays/heartbleed.html