5

Suppose in a C++ program I use a memory region for temporarily storing an encryption key and don't overwrite that region afterwards. Then my program wants to send a data packet over the network.

Due to an error in code it reads not only the prepared data packet but also an adjacent memory region and the latter happens to be the same as the region which was previously used for the key. So although the program never planned to do so it does transfer the secret over the wire.

Is there a common name for such kind of software defects?

Improve this question

3 Answers 3

Reset to default
5

The kind you described is indeed a buffer overrun error, as @Thomas Pornin describes.

There is another related vulnerability class, which falls under use of uninitialized data. This can occur if code reads from a memory location that it fails to initialize, and then sends the value it read out over the network. If you get unlucky, and that memory location previously held a cryptographic key or other secret, such a bug can disclose secrets. Here are some examples of this kind of vulnerability in various software packages: in OpenSSH, in Kerberos, and in Linux kernel drivers. See also CWE-665: Improper Initialization for a broader view.

All of these fall under the general category of information disclosure flaws.

Improve this answer
6

This bug is a buffer overflow -- the "reading" kind. A buffer overflow is where some code uses a buffer (a sequence of elements in memory) and accesses elements beyond the boundaries of the buffer (usually, it is called "overflow" when the access is past the last element, and "underflow" when it is before the first element).

Traditionally, the buffer overflows which lead to the biggest security holes are those where data is written past the buffer end, because it allows an attacker to alter the behavior of the attacked software, up to an including launching a shell. However, read accesses beyond the buffer end can be an important security issue, as your example shows: it can lead to leakage of confidential data (an encryption key is just the archetypal confidential data).

I have not encountered any specific term for the situation where the buffer overflows leaks confidential data which turns out to be an encryption key. Most pedagogical presentations of that issue use "credit card number" as a striking example of why data leaking is bad.

Improve this answer
5

What you're describing has been called a "data leak", with the classic example being the EtherLeak found by @stake back in 2003. That leak occurred at the OS level, but I presume that a C++ program that also failed to clear buffers it was using in network communications would fall into the same category.

Improve this answer
1
  • Yes, it's a data leak, but data leak is a much broader category which says nothing about the way that data was leaked (and is not specific to reading from uninitialized/out-of-bounds regions of memory). Commented Aug 10, 2011 at 22:17

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.