Out-of-bounds Read

Description

Out-of-bounds Read is a vulnerability that occurs when software reads data from a memory location outside the intended boundaries of a buffer. This happens when array indices, pointer arithmetic, or buffer offsets are calculated incorrectly or not properly validated against buffer limits. While out-of-bounds reads typically do not directly enable code execution, they can expose sensitive information from adjacent memory including cryptographic keys, passwords, user data, and memory addresses that help bypass ASLR. The Heartbleed vulnerability demonstrated that out-of-bounds reads can have catastrophic impact at scale.

Risk

Out-of-bounds reads pose significant confidentiality risks by exposing sensitive data stored in memory. In cryptographic applications, they can leak private keys and session secrets. In web servers, they may expose authentication tokens, user credentials, and personal data. Memory address leaks enable attackers to bypass ASLR, facilitating subsequent exploitation of memory corruption vulnerabilities. In some cases, reading unmapped memory causes crashes leading to denial of service. The Heartbleed vulnerability allowed attackers to read up to 64KB of server memory per request, affecting millions of servers and exposing countless private keys and user credentials.

Solution

Always validate that read operations remain within allocated buffer bounds. Use safe container types that perform bounds checking (std::vector, std::array in C++). Enable compiler bounds checking where available. Use AddressSanitizer during development to catch out-of-bounds reads. Implement strict input validation for array indices and buffer offsets. Review all pointer arithmetic for potential underflow/overflow. Consider memory-safe languages for security-critical data processing.

Common Consequences

Impact	Details
Confidentiality	Scope: Confidentiality Sensitive data including credentials, cryptographic keys, and personal information can be exposed from adjacent memory locations.
Availability	Scope: Availability Reading from unmapped memory pages causes segmentation faults and application crashes.
Access Control	Scope: Security Bypass Leaked memory addresses enable ASLR bypass, facilitating exploitation of other vulnerabilities.

Example Code + Solution Code

Vulnerable Code

#include <string.h>

// VULNERABLE: Out-of-bounds read
void heartbleed_like(char *data, size_t claimed_len) {
    char response[65536];

    // Attacker claims length larger than actual data
    // Reads beyond data buffer into adjacent memory
    memcpy(response, data, claimed_len);

    send_response(response, claimed_len);  // Leaks memory contents
}

// VULNERABLE: Array index not validated
int get_item(int *array, size_t array_size, int index) {
    // Negative index or index >= array_size reads out of bounds
    return array[index];
}

Fixed Code

#include <string.h>
#include <stdint.h>

// SAFE: Validate length against actual data
void safe_response(char *data, size_t actual_len, size_t claimed_len) {
    char response[65536];

    // Use minimum of claimed and actual length
    size_t copy_len = claimed_len < actual_len ? claimed_len : actual_len;

    // Additional bounds check against response buffer
    if (copy_len > sizeof(response)) {
        copy_len = sizeof(response);
    }

    memcpy(response, data, copy_len);
    send_response(response, copy_len);
}

// SAFE: Bounds-checked array access
int get_item_safe(int *array, size_t array_size, size_t index) {
    if (index >= array_size) {
        return -1;  // Error indicator or throw exception
    }
    return array[index];
}

---

Exploited in the Wild

Heartbleed (OpenSSL, 2014)

CVE-2014-0160 (Heartbleed) was an out-of-bounds read in OpenSSL's TLS heartbeat extension that allowed attackers to read up to 64KB of server memory per request. The vulnerability affected an estimated 17% of secure web servers and exposed private keys, session cookies, and user credentials. It remains one of the most impactful vulnerabilities ever discovered.

• https://heartbleed.com/

Cloudbleed (Cloudflare, 2017)

A parser bug in Cloudflare's HTML parser caused out-of-bounds reads that leaked sensitive data from other customers' requests into cached pages. The leaked data included passwords, API keys, and authentication tokens.

• https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/

---

Tools to test/exploit

• AddressSanitizer — runtime detection of out-of-bounds reads with precise error reporting.

• Valgrind — memory error detector that identifies invalid reads.

• AFL++ — fuzzer effective at triggering out-of-bounds conditions.

---

CVE Examples

• CVE-2014-0160 — Heartbleed OpenSSL buffer over-read exposing server memory.

• CVE-2017-0143 — EternalBlue SMB out-of-bounds read enabling WannaCry.

---

References

1. MITRE. "CWE-125: Out-of-bounds Read." https://cwe.mitre.org/data/definitions/125.html

2. Heartbleed. "The Heartbleed Bug." https://heartbleed.com/