VariantDraftCWE-126

CWE-126: Buffer Over-read

Description

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Abstraction: VariantA weakness tied to a specific language, technology or resource.
Likelihood of exploit: Not rated by MITRE
Status: Draft

Common consequences

Confidentiality
Read Memory
Confidentiality
Bypass Protection Mechanism
By reading out-of-bounds memory, an attacker might be able to get secret values, such as memory addresses, which can bypass protection mechanisms such as ASLR in order to improve the reliability and likelihood of exploiting a separate weakness to achieve code execution instead of just denial of service.
AvailabilityIntegrity
DoS: Crash, Exit, or Restart
An attacker might be able to cause a crash or other denial of service by causing the product to read a memory location that is not allowed (such as a segmentation fault), or to cause other conditions in which the read operation returns more data than is expected.

Related weaknesses

Parent weaknesses

CAPEC attack patterns that exploit it

CWE 4.20 links no CAPEC attack pattern to this weakness.

Common consequences

Confidentiality

Read Memory

Confidentiality

Bypass Protection Mechanism

By reading out-of-bounds memory, an attacker might be able to get secret values, such as memory addresses, which can bypass protection mechanisms such as ASLR in order to improve the reliability and likelihood of exploiting a separate weakness to achieve code execution instead of just denial of service.

AvailabilityIntegrity

DoS: Crash, Exit, or Restart

An attacker might be able to cause a crash or other denial of service by causing the product to read a memory location that is not allowed (such as a segmentation fault), or to cause other conditions in which the read operation returns more data than is expected.