Out-of-bounds Write

Description

Out-of-bounds Write is a vulnerability that occurs when software writes data to a memory location outside the intended boundaries of a buffer. This can happen through buffer overflows, incorrect array indexing, pointer arithmetic errors, or integer overflows affecting size calculations. Out-of-bounds writes are extremely dangerous as they can corrupt adjacent data, overwrite control flow information (return addresses, function pointers), modify security flags, or corrupt heap metadata. This vulnerability consistently ranks as one of the most dangerous software weaknesses due to its direct path to arbitrary code execution.

Risk

Out-of-bounds writes are among the most exploitable and dangerous vulnerability classes. They enable direct memory corruption that attackers leverage for code execution through return address overwrites, vtable corruption, or heap exploitation techniques. The vulnerability affects critical software including operating systems, browsers, network services, and embedded systems. Remote code execution through out-of-bounds writes has enabled major malware campaigns and APT attacks. The 2021 CWE Top 25 ranked Out-of-bounds Write as the #1 most dangerous software weakness.

Solution

Always validate write boundaries before buffer operations. Use safe functions with explicit size parameters (snprintf, strncpy, memcpy with validated sizes). Employ C++ containers (std::vector, std::string) that manage bounds automatically. Enable compiler protections: stack canaries, ASLR, DEP, CFI. Use AddressSanitizer and memory debugging tools during development. Implement integer overflow checks before size calculations. Consider memory-safe languages (Rust, Go) for new development. Audit all array index calculations and pointer arithmetic.

Common Consequences

Impact	Details
Integrity	Scope: Integrity Corrupts adjacent memory including application data, security flags, and control structures.
Access Control	Scope: Code Execution Overwriting return addresses, function pointers, or vtables enables arbitrary code execution.
Availability	Scope: Availability Memory corruption commonly causes crashes; attackers may intentionally cause denial of service.

Example Code + Solution Code

Vulnerable Code

// VULNERABLE: Out-of-bounds write via user-controlled index
void update_score(int *scores, int index, int value) {
    scores[index] = value;  // No bounds check - arbitrary write
}

// VULNERABLE: Integer overflow in size calculation
void copy_data(char *dest, char *src, unsigned int count) {
    unsigned int size = count * sizeof(int);  // Overflow possible
    memcpy(dest, src, size);  // Writes beyond dest
}

Fixed Code

#include <stdint.h>
#include <stdbool.h>

// SAFE: Bounds-checked write
bool update_score(int *scores, size_t scores_size, size_t index, int value) {
    if (index >= scores_size) {
        return false;  // Bounds check failed
    }
    scores[index] = value;
    return true;
}

// SAFE: Integer overflow protection
bool copy_data_safe(char *dest, size_t dest_size, char *src, size_t count) {
    // Check for integer overflow
    if (count > SIZE_MAX / sizeof(int)) {
        return false;
    }
    size_t size = count * sizeof(int);

    // Check destination bounds
    if (size > dest_size) {
        return false;
    }

    memcpy(dest, src, size);
    return true;
}

---

Exploited in the Wild

EternalBlue/WannaCry (Windows SMB, 2017)

CVE-2017-0144 was an out-of-bounds write in Windows SMB that enabled the devastating WannaCry ransomware attack affecting over 200,000 systems across 150 countries, causing billions in damages.

• https://www.cisa.gov/news-events/alerts/2017/05/12/indicators-associated-wannacry-ransomware

Chrome V8 Type Confusion (Chrome, Multiple)

Multiple out-of-bounds write vulnerabilities in Chrome's V8 engine have been exploited in the wild for remote code execution against browser users.

• https://chromereleases.googleblog.com/

---

Tools to test/exploit

• AddressSanitizer — detects out-of-bounds writes at runtime.

• AFL++ — coverage-guided fuzzer for discovering memory corruption.

• libFuzzer — in-process fuzzing for memory safety testing.

---

CVE Examples

• CVE-2017-0144 — EternalBlue SMB out-of-bounds write enabling WannaCry.

• CVE-2021-21224 — Chrome V8 type confusion leading to out-of-bounds write.

---

References

1. MITRE. "CWE-787: Out-of-bounds Write." https://cwe.mitre.org/data/definitions/787.html

2. CWE Top 25. "2023 CWE Top 25 Most Dangerous Software Weaknesses." https://cwe.mitre.org/top25/