Stack-based Buffer Overflow
CWE-121: Stack-based Buffer Overflow
A stack-based buffer overflow is an out-of-bounds write into a buffer that lives on the call stack, usually a local array. Because the stack also holds saved return addresses and frame pointers, overflowing a local buffer can redirect execution when the function returns. Modern defences such as stack canaries, non-executable stacks, and ASLR make exploitation harder, and attackers respond with techniques such as return-oriented programming (ROP).
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A function declares char name[32] and copies an attacker-controlled string into it with no length check, overwriting the saved return address.
- A firmware HTTP server parses a cookie into a fixed local buffer, giving a pre-authentication remote code execution path.
- A logging function builds a message with sprintf into a 256-byte local buffer and includes an attacker-controlled HTTP header, so a long header overwrites the saved return address.
How to mitigate it
- Bound every copy into a local buffer by the buffer's real size, and prefer safe string and container types.
- Compile with stack protectors (for example -fstack-protector-strong), and keep NX/DEP and ASLR enabled.
- Enable control-flow integrity or shadow stacks (such as Intel CET) where the platform supports them.
- Fuzz input-handling functions and review code for unsafe copy functions writing into local arrays.
Go deeper
Practice this topic
Test your knowledge of Stack-based Buffer Overflow with exam-style practice questions.