Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-121 (栈缓冲区溢出) — Vulnerability Class 2518

2518 vulnerabilities classified as CWE-121 (栈缓冲区溢出). AI Chinese analysis included.

CWE-121 represents a critical memory safety weakness where program data exceeds the allocated bounds of a stack-allocated buffer, corrupting adjacent memory structures. Attackers typically exploit this vulnerability by injecting malicious payloads that overwrite the function’s return address or saved frame pointer, thereby hijacking control flow to execute arbitrary code with the privileges of the compromised process. This exploitation is particularly dangerous because stack buffers are local variables, making the attack surface common in low-level languages like C and C++. Developers mitigate this risk by enforcing strict input validation, utilizing safe string handling functions that prevent unbounded writes, and adopting modern programming languages with automatic memory management. Additionally, implementing compiler-level protections such as stack canaries and Address Space Layout Randomization significantly raises the barrier for successful exploitation, ensuring system integrity remains intact against buffer overflow attempts.

MITRE CWE Description
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Common Consequences (3)
AvailabilityModify Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity, Confidentiality, Availability, Access ControlModify Memory, Execute Unauthorized Code or Commands, Bypass Protection Mechanism
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy.
Integrity, Confidentiality, Availability, Access Control, OtherModify Memory, Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Mitigations (5)
Operation, Build and CompilationUse automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses…
Effectiveness: Defense in Depth
Architecture and DesignUse an abstraction library to abstract away risky APIs. Not a complete solution.
ImplementationImplement and perform bounds checking on input.
ImplementationDo not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Operation, Build and CompilationRun or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported…
Effectiveness: Defense in Depth
Examples (2)
While buffer overflow examples can be rather complex, it is possible to have very simple, yet still exploitable, stack-based buffer overflows:
#define BUFSIZE 256 int main(int argc, char **argv) { char buf[BUFSIZE]; strcpy(buf, argv[1]); }
Bad · C
This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.
void host_lookup(char *user_supplied_addr){ struct hostent *hp; in_addr_t *addr; char hostname[64]; in_addr_t inet_addr(const char *cp); /*routine that ensures user_supplied_addr is in the right format for conversion */ validate_addr_form(user_supplied_addr); addr = inet_addr(user_supplied_addr); hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET); strcpy(hostname, hp->h_name); }
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2019-10164 PostgreSQL 缓冲区错误漏洞 — PostgreSQL 8.8 -2019-06-26
CVE-2018-20655 Facebook WhatsApp和WhatsApp Business 缓冲区错误漏洞 — WhatsApp for iOS 9.8 -2019-06-14
CVE-2018-6339 Facebook WhatsApp Business 缓冲区错误漏洞 — WhatsApp for Android 9.1 -2019-06-14
CVE-2018-6349 Facebook WhatsApp和WhatsApp Business 缓冲区错误漏洞 — WhatsApp for Android 9.8 -2019-06-14
CVE-2019-10967 Emerson Electric Ovation OCR400 Controller 缓冲区错误漏洞 — Emerson Ovation OCR400 Controller 8.8 -2019-05-28
CVE-2015-1006 多款Opto 22产品缓冲区错误漏洞 — PAC Project Professional 9.8 -2019-05-10
CVE-2019-10954 Rockwell Automation CompactLogix 5370 Stack-based Buffer Overflow — CompactLogix 5370 L1 controllers 7.5 -2019-05-01
CVE-2019-3930 多款路由器缓冲区错误漏洞 — Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4. 9.8 -2019-04-30
CVE-2019-10947 Delta Electronics Delta Industrial Automation CNCSoft 缓冲区错误漏洞 — Delta Industrial Automation CNCSoft 7.8 -2019-04-17
CVE-2019-0008 QFX5000 Series, EX4300, EX4600: A stack buffer overflow vulnerability in Packet Forwarding Engine manager (FXPC) process — Junos OS 9.8 -2019-04-10
CVE-2019-6550 Advantech WebAccess/SCADA 缓冲区错误漏洞 — WebAccess/SCADA 9.8 -2019-04-05
CVE-2019-6553 Rockwell Automation RSLinx Classic 缓冲区错误漏洞 — RSLinx Classic 9.8 -2019-04-04
CVE-2014-9189 Honeywell International Experion PKS 缓冲区错误漏洞 — Experion PKS 9.8 -2019-03-25
CVE-2015-1007 多款Opto 22产品缓冲区错误漏洞 — PAC Project Professional 7.8 -2019-03-25
CVE-2016-5800 Fatek Automation PM Designer和Automation FV Designer 缓冲区错误漏洞 — Automation PM Designer V3 7.5 -2019-03-21
CVE-2018-17937 gpsd和microjson 缓冲区错误漏洞 — gpsd and microjson (Open Source Project) 8.8 -2019-03-13
CVE-2019-8269 UltraVNC 缓冲区错误漏洞 — UltraVNC 7.5 -2019-03-09
CVE-2019-8276 UltraVNC 缓冲区错误漏洞 — UltraVNC 7.5 -2019-03-09
CVE-2019-3921 Nokia Alcatel Lucent I-240W-Q GPON ONT 缓冲区错误漏洞 — Alcatel Lucent I-240W-Q GPON ONT 8.8 -2019-03-05
CVE-2019-3922 Nokia Alcatel Lucent I-240W-Q GPON ONT 缓冲区错误漏洞 — Alcatel Lucent I-240W-Q GPON ONT 9.8 -2019-03-05
CVE-2019-8263 UltraVNC 缓冲区错误漏洞 — UltraVNC 6.5 -2019-03-05
CVE-2019-6537 WECON Technologies LeviStudioU 缓冲区错误漏洞 — WECON LeviStudioU 7.8 -2019-02-13
CVE-2019-3822 Haxx libcurl 缓冲区错误漏洞 — curl 9.8 -2019-02-06
CVE-2018-5410 Dokan file system driver contains a stack-based buffer overflow — Open Source File System 7.8 -2019-01-07
CVE-2018-20247 Foxit Quick PDF Library 缓冲区错误漏洞 — Foxit Quick PDF Library 8.8 -2018-12-24
CVE-2018-11463 多款Siemens产品缓冲区错误漏洞 — SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 7.8 -2018-12-12
CVE-2018-18993 Omron CX-One 缓冲区错误漏洞 — CX-One (CX-Programmer and CX-Server) 7.8 -2018-12-04
CVE-2018-17930 Teledyne DALSA Sherlock 缓冲区错误漏洞 — Teledyne DALSA Sherlock 9.8 -2018-11-28
CVE-2018-17614 Losant Arduino MQTT Client 缓冲区错误漏洞 — Losant Arduino MQTT Client 8.8 -2018-11-13
CVE-2018-17916 Schneider Electric InduSoft Web Studio和InTouch Edge HMI 缓冲区错误漏洞 — InduSoft Web Studio, and InTouch Edge HMI (formerly InTouch Machine Edition) 9.8 -2018-11-02

Vulnerabilities classified as CWE-121 (栈缓冲区溢出) represent 2518 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.