CWE-170 — Improper Null Termination
CWE-170: Improper Null Termination
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Incomplete |
| Likelihood of exploit | Medium |
Description
The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
Null termination errors frequently occur in two different ways. An off-by-one error could cause a null to be written out of bounds, leading to an overflow. Or, a program could use a strncpy() function call incorrectly, which prevents a null terminator from being added at all. Other scenarios are possible.
Common consequences
- Confidentiality, Integrity, Availability: Read Memory, Execute Unauthorized Code or Commands
- Confidentiality, Integrity, Availability: DoS: Crash, Exit, or Restart, Read Memory, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
- Integrity, Availability: Modify Memory, DoS: Crash, Exit, or Restart
- Integrity, Confidentiality, Availability, Access Control, Other: Alter Execution Logic, Execute Unauthorized Code or Commands
Mitigations
Requirements — Use a language that is not susceptible to these issues. However, be careful of null byte interaction errors (CWE-626) with lower-level constructs that may be written in a language that is susceptible.
Implementation — Ensure that all string functions used are understood fully as to how they append null characters. Also, be wary of off-by-one errors when appending nulls to the end of strings.
Implementation — If performance constraints permit, special code can be added that validates null-termination of string buffers, this is a rather naive and error-prone solution.
Implementation — Switch to bounded string manipulation functions. Inspect buffer lengths involved in the buffer overrun trace reported with the defect.
Implementation — Add code that fills buffers with nulls (however, the length of buffers still needs to be inspected, to ensure that the non null-terminated string is not written at the physical end of the buffer).
References
- CWE page: https://cwe.mitre.org/data/definitions/170.html
- CWE list: https://cwe.mitre.org/data/index.html