CWE-125 (跨界内存读) — Vulnerability Class 4343

4343 vulnerabilities classified as CWE-125 (跨界内存读). AI Chinese analysis included.

CWE-125, Out-of-bounds Read, is a memory safety weakness where software accesses memory locations outside the designated buffer boundaries, either before its start or past its end. This vulnerability typically arises from insufficient bounds checking during array indexing or pointer arithmetic, allowing attackers to read sensitive data such as stack canaries, cryptographic keys, or internal application state. By leveraging this flaw, adversaries can achieve information disclosure or potentially facilitate further exploitation techniques like heap spraying. Developers mitigate this risk by implementing rigorous input validation, utilizing static analysis tools to detect unsafe memory access patterns, and adopting safer programming languages or libraries that enforce automatic bounds checking. Additionally, employing compiler protections like Address Sanitizer during development helps identify these errors early, ensuring that memory reads remain strictly within allocated limits to prevent unauthorized data exposure.

MITRE CWE Description

The product reads data past the end, or before the beginning, of the intended buffer.

Common Consequences (4)

Confidentiality Read Memory

An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.

Confidentiality Bypass Protection Mechanism

Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.

Availability DoS: Crash, Exit, or Restart

An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.

Other Varies by Context

The read operation could produce other undefined or unexpected results.

Mitigations (2)

Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…

Architecture and Design Use a language that provides appropriate memory abstractions.

Examples (2)

In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the method

int getValueFromArray(int *array, int len, int index) { int value; // check that the array index is less than the maximum // length of the array if (index < len) { // get the value at the specified index of the array value = array[index]; } // if array index is invalid then output error message // and return value indicating error else { printf("Value is: %d\n", array[index]); value = -1; } return value; }

Bad · C

... // check that the array index is within the correct // range of values for the array if (index >= 0 && index < len) { ...

Good · C

In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.

int processMessageFromSocket(int socket) { int success; char buffer[BUFFER_SIZE]; char message[MESSAGE_SIZE]; // get message from socket and store into buffer //Ignoring possibliity that buffer > BUFFER_SIZE if (getMessage(socket, buffer, BUFFER_SIZE) > 0) { // place contents of the buffer into message structure ExMessage *msg = recastBuffer(buffer); // copy message body into string for processing int index; for (index = 0; index < msg->msgLength; index++) { message[index] = msg->msgBody[index]; } message[index] = '\0'; // process message success = processMessage(message); } return success; }

Bad · C

CVE ID	Title	CVSS	Severity	Published
CVE-2022-35671	Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability — Acrobat Reader	5.5	Medium	2022-08-11
CVE-2022-35678	Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability — Acrobat Reader	5.5	Medium	2022-08-11
CVE-2022-35673	Adobe FrameMaker SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability — FrameMaker	7.8	High	2022-08-11
CVE-2022-35674	Adobe FrameMaker SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability — FrameMaker	7.8	High	2022-08-11
CVE-2022-20792	ClamAV AntiVirus 缓冲区错误漏洞 — Clam AntiVirus (ClamAV)	7.8	High	2022-08-10
CVE-2021-33643	openEuler 缓冲区错误漏洞 — libtar	9.1	-	2022-08-09
CVE-2021-33644	openEuler 缓冲区错误漏洞 — libtar	9.1	-	2022-08-09
CVE-2022-35926	Out-of-bounds read in IPv6 neighbor solicitation in Contiki-NG — contiki-ng	5.9	Medium	2022-08-04
CVE-2022-33968	BIG-IP LTM and APM NTLM vulnerability CVE-2022-33968 — BIG-IP	3.7	Low	2022-08-04
CVE-2022-2581	Out-of-bounds Read in vim/vim — vim/vim	7.8	-	2022-08-01
CVE-2022-35672	Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability — Acrobat Reader	7.8	-	2022-07-27
CVE-2022-35669	Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability — Acrobat Reader	5.5	Medium	2022-07-27
CVE-2022-33319	Mitsubishi Electric MC Works64 缓冲区错误漏洞 — GENESIS64	8.2	High	2022-07-20
CVE-2022-34875	Foxit PDF Reader 缓冲区错误漏洞 — PDF Reader	5.5	-	2022-07-18
CVE-2022-34874	Foxit PDF Reader 缓冲区错误漏洞 — PDF Reader	5.5	-	2022-07-18
CVE-2022-34873	Foxit PDF Reader 缓冲区错误漏洞 — PDF Reader	3.3	-	2022-07-18
CVE-2022-28682	Foxit PDF Reader 缓冲区错误漏洞 — PDF Reader	7.8	-	2022-07-18
CVE-2022-28681	Foxit PDF Reader 缓冲区错误漏洞 — PDF Reader	3.3	-	2022-07-18
CVE-2022-28670	Foxit PDF Reader 缓冲区错误漏洞 — PDF Reader	5.5	-	2022-07-18
CVE-2022-34889	Corel Parallels Desktop 缓冲区错误漏洞 — Desktop	8.2	-	2022-07-15
CVE-2022-34252	Adobe InCopy Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability — InCopy	5.5	Medium	2022-07-15
CVE-2022-34248	Adobe InDesign Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability — InDesign	5.5	Medium	2022-07-15
CVE-2022-34242	Adobe Character Animator SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability — Character Animator	7.8	High	2022-07-15
CVE-2022-34239	Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability — Acrobat Reader	5.5	Medium	2022-07-15
CVE-2022-34236	Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability — Acrobat Reader	5.5	Medium	2022-07-15
CVE-2022-34226	Adobe Acrobat Reader DC PDF Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability — Acrobat Reader	7.8	High	2022-07-15
CVE-2022-34222	Adobe Acrobat Reader DC query Out-Of-Bounds Read Remote Code Execution Vulnerability — Acrobat Reader	7.8	High	2022-07-15
CVE-2022-34215	Adobe Acrobat Reader DC Annotation Polygon Out-Of-Bounds Read Remote Code Execution Vulnerability — Acrobat Reader	7.8	High	2022-07-15
CVE-2022-2380	Linux kernel 缓冲区错误漏洞 — Kernel	5.5	-	2022-07-13
CVE-2022-34465	Siemens Simcenter Femap和Siemens Parasolid 缓冲区错误漏洞 — Parasolid V33.1	7.8	-	2022-07-12

Vulnerabilities classified as CWE-125 (跨界内存读) represent 4343 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.