Definition
Buffer Over-Read
A buffer over-read is a memory-safety bug in which a program reads past the bounds of a buffer, leaking memory that the caller was never meant to see. Unlike a buffer overflow it does not corrupt control data, but it breaks confidentiality — the bytes the attacker can now read may be anything else the process has in memory nearby.
Mechanism
Why an over-read crosses into adjacent memory
Memory is contiguous, and C pointers give byte-indexed access with no automatic bound enforcement. A read using an attacker-controlled length, or a copy that trusts a length field the attacker could forge, will happily walk past the buffer’s end and pull in neighbouring bytes — local stack variables of another function, heap metadata, or, in a long-lived daemon, secrets held elsewhere in the process.
Example
Heartbleed (2014, CVE-2014-0160)
Heartbleed is the canonical buffer over-read.
- the bug
- the OpenSSL Heartbeat extension accepted a user-supplied length but did not check it against the actual payload, then used that unsanitised length as the parameter to a memory copy
- the leak
- this allowed anyone on the Internet to read up to 64 KiB of the protected process’s memory per request — including private keys, session tickets, and decrypted packets held in memory
- why it was severe
- a single over-read of 64 KiB made off with the server’s private key, after which the attacker could impersonate the server and decrypt past and future traffic until the key was rotated