CWE-170: Improper Null Termination (Base)

Description: The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

Extended Description: Null termination errors frequently occur in two different ways. An off-by-one error could cause a null to be written out of bounds, leading to an overflow. Or, a program could use a strncpy() function call incorrectly, which prevents a null terminator from being added at all. Other scenarios are possible.



Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:SCOPE:Integrity:SCOPE:Availability:IMPACT:Read Memory:IMPACT:Execute Unauthorized Code or Commands:NOTE:The case of an omitted null character is the most dangerous of the possible issues. This will almost certainly result in information disclosure, and possibly a buffer overflow condition, which may be exploited to execute arbitrary code.::SCOPE:Confidentiality:SCOPE:Integrity:SCOPE:Availability:IMPACT:DoS: Crash, Exit, or Restart:IMPACT:Read Memory:IMPACT:DoS: Resource Consumption (CPU):IMPACT:DoS: Resource Consumption (Memory):NOTE:If a null character is omitted from a string, then most string-copying functions will read data until they locate a null character, even outside of the intended boundaries of the string. This could: cause a crash due to a segmentation fault cause sensitive adjacent memory to be copied and sent to an outsider trigger a buffer overflow when the copy is being written to a fixed-size buffer.::SCOPE:Integrity:SCOPE:Availability:IMPACT:Modify Memory:IMPACT:DoS: Crash, Exit, or Restart:NOTE:Misplaced null characters may result in any number of security problems. The biggest issue is a subset of buffer overflow, and write-what-where conditions, where data corruption occurs from the writing of a null character over valid data, or even instructions. A randomly placed null character may put the system into an undefined state, and therefore make it prone to crashing. A misplaced null character may corrupt other data in memory.::SCOPE:Integrity:SCOPE:Confidentiality:SCOPE:Availability:SCOPE:Access Control:SCOPE:Other:IMPACT:Alter Execution Logic:IMPACT:Execute Unauthorized Code or Commands:NOTE:Should the null character corrupt the process flow, or affect a flag controlling access, it may lead to logical errors which allow for the execution of arbitrary code.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Requirements:DESCRIPTION:Use a language that is not susceptible to these issues. However, be careful of null byte interaction errors (CWE-626) with lower-level constructs that may be written in a language that is susceptible.::PHASE:Implementation:DESCRIPTION:Ensure that all string functions used are understood fully as to how they append null characters. Also, be wary of off-by-one errors when appending nulls to the end of strings.::PHASE:Implementation:DESCRIPTION:If performance constraints permit, special code can be added that validates null-termination of string buffers, this is a rather naive and error-prone solution.::PHASE:Implementation:DESCRIPTION:Switch to bounded string manipulation functions. Inspect buffer lengths involved in the buffer overrun trace reported with the defect.::PHASE:Implementation:DESCRIPTION:Add code that fills buffers with nulls (however, the length of buffers still needs to be inspected, to ensure that the non null-terminated string is not written at the physical end of the buffer).::

Observed Examples: ::REFERENCE:CVE-2000-0312:DESCRIPTION:Attacker does not null-terminate argv[] when invoking another program.:LINK:https://www.cve.org/CVERecord?id=CVE-2000-0312::REFERENCE:CVE-2003-0777:DESCRIPTION:Interrupted step causes resultant lack of null termination.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0777::REFERENCE:CVE-2004-1072:DESCRIPTION:Fault causes resultant lack of null termination, leading to buffer expansion.:LINK:https://www.cve.org/CVERecord?id=CVE-2004-1072::REFERENCE:CVE-2001-1389:DESCRIPTION:Multiple vulnerabilities related to improper null termination.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-1389::REFERENCE:CVE-2003-0143:DESCRIPTION:Product does not null terminate a message buffer after snprintf-like call, leading to overflow.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0143::REFERENCE:CVE-2009-2523:DESCRIPTION:Chain: product does not handle when an input string is not NULL terminated (CWE-170), leading to buffer over-read (CWE-125) or heap-based buffer overflow (CWE-122).:LINK:https://www.cve.org/CVERecord?id=CVE-2009-2523::



Notes: ::TYPE:Relationship:NOTE:Factors: this is usually resultant from other weaknesses such as off-by-one errors, but it can be primary to boundary condition violations such as buffer overflows. In buffer overflows, it can act as an expander for assumed-immutable data.::TYPE:Relationship:NOTE:Overlaps missing input terminator.::TYPE:Applicable Platform:NOTE:Conceptually, this does not just apply to the C language; any language or representation that involves a terminator could have this type of problem.::TYPE:Maintenance:NOTE:As currently described, this entry is more like a category than a weakness.::