目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1310 元

100%
请我们喝杯咖啡

CWE-126 缓冲区上溢读取 类漏洞列表 425

CWE-126 缓冲区上溢读取 类弱点 425 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-126 缓冲区过读是一种内存安全漏洞，指程序通过索引或指针访问了目标缓冲区之后的非法内存区域。攻击者利用此缺陷可读取敏感数据或引发程序崩溃，进而可能导致信息泄露或拒绝服务。开发者应避免此类问题，需严格验证内存访问边界，确保读写操作不超出缓冲区合法范围，并采用安全的内存管理函数以防止越界访问。

MITRE CWE 官方描述
CWE：CWE-126 Buffer Over-read（缓冲区越界读） 英文：The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
常见影响 (3)
ConfidentialityRead Memory
ConfidentialityBypass Protection Mechanism
By reading out-of-bounds memory, an attacker might be able to get secret values, such as memory addresses, which can bypass protection mechanisms such as ASLR in order to improve the reliability and likelihood of exploiting a separate weakness to achieve code execution instead of just denial of serv…
Availability, IntegrityDoS: Crash, Exit, or Restart
An attacker might be able to cause a crash or other denial of service by causing the product to read a memory location that is not allowed (such as a segmentation fault), or to cause other conditions in which the read operation returns more data than is expected.
代码示例 (2)
In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.
int processMessageFromSocket(int socket) { int success; char buffer[BUFFER_SIZE]; char message[MESSAGE_SIZE]; // get message from socket and store into buffer //Ignoring possibliity that buffer > BUFFER_SIZE if (getMessage(socket, buffer, BUFFER_SIZE) > 0) { // place contents of the buffer into message structure ExMessage *msg = recastBuffer(buffer); // copy message body into string for processing int index; for (index = 0; index < msg->msgLength; index++) { message[index] = msg->msgBody[index]; } message[index] = '\0'; // process message success = processMessage(message); } return success; }
Bad · C
The following C/C++ example demonstrates a buffer over-read due to a missing NULL terminator. The main method of a pattern matching utility that looks for a specific pattern within a specific file uses the string strncopy() method to copy the command line user input file name and pattern to the Filename and Pattern character arrays respectively.
int main(int argc, char **argv) { char Filename[256]; char Pattern[32]; /* Validate number of parameters and ensure valid content */ ... /* copy filename parameter to variable, may cause off-by-one overflow */ strncpy(Filename, argv[1], sizeof(Filename)); /* copy pattern parameter to variable, may cause off-by-one overflow */ strncpy(Pattern, argv[2], sizeof(Pattern)); printf("Searching file: %s for the pattern: %s\n", Filename, Pattern); Scan_File(Filename, Pattern); }
Bad · C
/* copy filename parameter to variable, no off-by-one overflow */ strncpy(Filename, argv[2], sizeof(Filename)-1); Filename[255]='\0'; /* copy pattern parameter to variable, no off-by-one overflow */ strncpy(Pattern, argv[3], sizeof(Pattern)-1); Pattern[31]='\0';
Good · C
CVE ID标题CVSS风险等级Published
CVE-2018-8799 rdesktop 缓冲区错误漏洞 — rdesktop 7.5 -2019-02-05
CVE-2018-8789 FreeRDP NTLM Authentication模块缓冲区错误漏洞 — FreeRDP 7.5 -2018-11-29
CVE-2018-14790 多款Fuji Electric产品缓冲区错误漏洞 — FRENIC LOADER of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace 9.8 -2018-10-01
CVE-2017-7668 Apache httpd 安全漏洞 — Apache HTTP Server 9.1 -2017-06-20
CVE-2017-7679 Apache httpd 安全漏洞 — Apache HTTP Server 9.8 -2017-06-20

CWE-126（缓冲区上溢读取） 是常见的弱点类别，本平台收录该类弱点关联的 425 条 CVE 漏洞。