Buffer overflow

A buffer overflow is a class of software vulnerability that has been a constant concern in security for decades.

It happens when more data is written into a temporary memory area, the buffer, than that area was sized to hold.

By taking advantage of that, an attacker can get malicious code to run, change how the program behaves, or in some cases take control of the machine.

It has been the mechanism behind a long list of attacks, and understanding it is still part of understanding how systems get taken over.

What characterises it

Memory gets overwritten. More data goes in than fits, and the surplus lands on adjacent memory that belonged to something else.

Code can end up executing. An attacker can place instructions in memory and arrange for them to run, which is where unauthorised control of the system comes from.

It is a way in, not the end. The overflow is usually the first step of a longer chain rather than the objective.

Why it is hard to get rid of

It affects a wide range of software. Anything written in a language that lets the programmer manage memory directly can have one, from a small utility to a large product.

Detection is not obvious. The behaviour is subtle, and the techniques used to reach exploitable memory vary a great deal.

Updates are the practical answer. Software updates, security patches and safer coding practices are what actually reduce the exposure, because they close the specific defects that are already known.

A worked example

A word processing program has a function that takes a string of text and stores it in a temporary buffer.

If the function does not check the length of that string, an attacker can deliberately supply one longer than the buffer can hold.

The surplus overwrites adjacent memory, including the areas that control where the program goes next.

From there the attacker can place their own instructions in memory and get them executed.

If that works, they have unauthorised access to the system, and the confidentiality and integrity of whatever the process could reach are gone with it.

Buffer overflow and remote code execution

The two get confused because they nearly always appear together, and they are two different layers.

The buffer overflow is the mechanism: more is written than fits and the memory next door gets overwritten.

Remote code execution (RCE) is the result: the attacker gets the machine to run their instructions. There are several routes to it and the memory bug is only one. You also get there because untrusted input reaches an interpreter or a shell, because untrusted bytes reach a deserialiser, or because an uploaded file lands somewhere the server will execute it.

And not every overflow ends in execution. Plenty of them only crash the process, which is a denial of service and not the same thing.

What decides severity is not the mechanism. It is which identity the process runs as, which secrets it holds and what network egress it has: the same defect inside a container with no credentials and no outbound access is a serious finding, and in a process holding the database password it is a breach in progress.