Improper Validation of Array Index

Description

Improper Validation of Array Index occurs when a program uses untrusted input to calculate or directly use an array index without validating that the index falls within the valid bounds of the array. This can lead to accessing memory outside the array boundaries, either before the array start (negative indices) or past the array end (indices greater than or equal to array length). Attackers can exploit this weakness to read or write arbitrary memory locations, leading to information disclosure, data corruption, or code execution.

Risk

Improper array index validation is highly exploitable and frequently leads to serious security vulnerabilities. When attackers control array indices, they can achieve arbitrary read or write primitives depending on the context. Read access enables information disclosure and ASLR bypass. Write access enables memory corruption and code execution. This vulnerability class is particularly prevalent in applications that process structured data formats, network protocols, or user-controlled configurations. The ease of exploitation makes it a frequent target in real-world attacks.

Solution

Always validate array indices against both minimum (0 or valid lower bound) and maximum (array length - 1) values before use. Use unsigned integer types for indices when negative values are invalid, but still check upper bounds. Implement bounds-checking array access functions or use safe containers (std::vector::at() in C++ throws on out-of-bounds). Enable compiler and runtime bounds checking where available. Use static analysis tools to identify unchecked array accesses. Consider memory-safe languages that enforce bounds checking.

Common Consequences

Impact	Details
Integrity	Scope: Memory Corruption Out-of-bounds write through invalid index corrupts adjacent memory, potentially including control structures.
Confidentiality	Scope: Information Disclosure Out-of-bounds read exposes sensitive data from adjacent memory locations.
Access Control	Scope: Code Execution Arbitrary write through controlled index enables overwriting function pointers, return addresses, or other control data.

Example Code + Solution Code

Vulnerable Code

#include <stdio.h>

// VULNERABLE: User-controlled index without bounds check
int get_value(int *array, int user_index) {
    // No validation - arbitrary read if user_index is out of bounds
    return array[user_index];
}

// VULNERABLE: Only upper bound checked
void set_value(int *array, int array_size, int index, int value) {
    if (index < array_size) {
        // Missing check for negative index!
        array[index] = value;  // Arbitrary write if index < 0
    }
}

// VULNERABLE: Index from parsed message
void process_message(unsigned char *msg, int msg_len) {
    int type_counts[256];
    memset(type_counts, 0, sizeof(type_counts));

    for (int i = 0; i < msg_len; i++) {
        int msg_type = msg[i];
        int msg_index = msg[i + 1];  // User-controlled index

        // No bounds validation on msg_index
        type_counts[msg_index]++;  // Out-of-bounds if msg_index >= 256
    }
}

Fixed Code

#include <stdio.h>
#include <stdint.h>
#include <stdbool.h>

// SAFE: Full bounds validation
bool get_value_safe(const int *array, size_t array_size,
                    size_t index, int *out_value) {
    // size_t is unsigned, handles negative via wrap
    if (index >= array_size) {
        return false;  // Out of bounds
    }
    *out_value = array[index];
    return true;
}

// SAFE: Check both bounds for signed index
bool set_value_safe(int *array, size_t array_size,
                    int index, int value) {
    // Check for negative AND upper bound
    if (index < 0 || (size_t)index >= array_size) {
        return false;  // Invalid index
    }
    array[index] = value;
    return true;
}

// SAFE: Validate parsed index before use
bool process_message_safe(const unsigned char *msg, size_t msg_len) {
    int type_counts[256];
    memset(type_counts, 0, sizeof(type_counts));

    // Process pairs of bytes (type, index)
    for (size_t i = 0; i + 1 < msg_len; i += 2) {
        unsigned char msg_index = msg[i + 1];

        // msg_index is unsigned char (0-255), fits in array[256]
        // Still validate explicitly for defense in depth
        if (msg_index < 256) {
            type_counts[msg_index]++;
        }
    }
    return true;
}

// C++ SAFE: Use bounds-checked access
#ifdef __cplusplus
#include <vector>
#include <stdexcept>

int get_value_cpp(const std::vector<int>& array, size_t index) {
    return array.at(index);  // Throws std::out_of_range if invalid
}
#endif

---

Exploited in the Wild

Automated Logic WebCtrl / Carrier i-Vu (Building Automation, 2025)

CVE-2025-0657 is a critical vulnerability in Automated Logic WebCtrl and Carrier i-Vu Gen5 router devices where improper validation of array indices allows specially crafted BACnet MS/TP packets to cause invalid memory access, leading to device fault states and network unavailability.

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Juniper Junos OS (Network Equipment, 2023)

Improper validation of array index vulnerabilities in Juniper Junos OS and Junos OS Evolved allowed attackers to cause denial of service conditions on network infrastructure.

• https://supportportal.juniper.net/

Linux Kernel Array Index Vulnerabilities (Linux, Multiple)

Multiple improper array index validation vulnerabilities have been discovered in Linux kernel subsystems, potentially enabling local privilege escalation.

• https://www.kernel.org/doc/html/latest/admin-guide/security-bugs.html

---

Tools to test/exploit

• AddressSanitizer — detects out-of-bounds array access at runtime.

• Coverity — static analysis that identifies unchecked array indices.

• CodeQL — semantic code analysis for finding array index vulnerabilities.

---

CVE Examples

• CVE-2025-0657 — Automated Logic WebCtrl array index vulnerability.

• CVE-2022-0847 — Dirty Pipe: Linux kernel array index flaw enabling privilege escalation.

• CVE-2021-22555 — Linux Netfilter heap out-of-bounds write via array index.

---

References

1. MITRE. "CWE-129: Improper Validation of Array Index." https://cwe.mitre.org/data/definitions/129.html

2. CERT. "ARR30-C. Do not form or use out-of-bounds pointers or array subscripts." https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C