CWE-121—Stack-based Buffer Overflow

Weakness Name

Stack-based Buffer Overflow

Description

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Common Consequences

Scope:

Availability

Impact:

Modify Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)

Notes:

Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.

Scope:

Integrity, Confidentiality, Availability, Access Control

Impact:

Modify Memory, Execute Unauthorized Code or Commands, Bypass Protection Mechanism

Notes:

Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy.

Scope:

Integrity, Confidentiality, Availability, Access Control, Other

Impact:

Modify Memory, Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Other

Notes:

When the consequence is arbitrary code execution, this can often be used to subvert any other security service.

Related Weaknesses

• CWE-787Out-of-bounds WriteHigh
• CWE-788Access of Memory Location After End of Buffer