Buffer Overflow Quiz

What is a buffer overflow?

A program writes data beyond the allocated size of a buffer.

What is the text segment?

Stores the program's executable instructions.

What is the data segment?

Holds global and static variables.

What is the BSS segment?

Stores global and static variables initialized to zero or without explicit initialization.

What does BSS stand for?

Block Started by Symbol.

What is stored on the stack?

Function calls, local variables, function parameters, and return addresses.

What is the heap used for?

Dynamic memory allocation, such as malloc().

Where are global variables stored?

Data segment.

Where are uninitialized static variables stored?

BSS segment.

Where are local variables stored?

Stack.

Where is dynamically allocated memory stored?

Heap.

What is a stack-based buffer overflow?

An overflow that can overwrite stack data, including return addresses.

What is a heap-based buffer overflow?

An overflow that can corrupt data in adjacent memory blocks.

What can a data/BSS overflow overwrite?

Global variables and potentially important program data or configurations.

What is a stack frame?

The stack area associated with a function call.

What is the purpose of a return address?

Identifies where execution continues after a function returns.

What is the frame pointer (EBP) used for?

References local variables and function arguments in a stack frame.

In what order are function arguments pushed onto the stack, according to the slides?

In reverse order.

What can happen if a return address is overwritten?

Execution may jump to an invalid address or attacker-controlled code.

What is gets() dangerous?

It reads input without checking the buffer's size.

What should be used instead of gets()?

fgets().

What does strcpy(dest, src) do?

Copies a string from src to dest.

Why is strcpy() dangerous?

It can keep writing when the source string is longer than the destination buffer.

What should be used instead of strcpy()?

strncpy().

What does strcat(dest, src) do?

Appends a string to the destination string.

Why is strcat() dangerous?

The combined strings may exceed the destination buffer's capacity.

What should be used instead of strcat()?

strncat().

Why can scanf() be dangerous?

Some options do not limit the maximum input length.

Why is scanf("%s", buffer) without a width limit risky?

Input can exceed the buffer's capacity.

What is shellcode?

Assembly or machine instructions used to launch a shell.

What does execve() do?

Executes a program and replaces the current process image with the new program.

What does a NOP instruction do?

Does nothing.

Why can zero bytes cause a shellcode problem?

strcpy() stops copying when it encounters a zero byte.

What is ASLR?

Address Space Layout Randomization.

What is the purpose of ASLR?

Makes memory addresses harder to predict by randomizing their locations.

What does ASLR setting 0 mean in the slides?

Address space is not randomized.

What does ASLR setting 1 mean in the slides?

Only stack memory addresses are randomized.

What does ASLR setting 2 mean in the slides?

Both stack and heap memory addresses are randomized.

What is the NX bit?

A feature that marks certain memory areas as non-executable.

What is StackGuard?

A compiler-based protection that checks a canary to detect stack corruption.

What does -fstack-protector do?

Adds code during compilation to protect against stack overflows.

What does -D_FORTIFY_SOURCE=2 do?

Replaces some memory and string functions with bounds-checking versions.

What are the developer-level countermeasures in the slides?

Use safer functions such as strncpy() and strncat().

What is CWE?

Common Weakness Enumeration, a list of software security weaknesses.

What is CWE-118?

Improper access of an indexable resource (range error).

What is CWE-119?

Improper restriction of operations within memory-buffer bounds.

What is CWE-120?

Buffer copy without checking input size (classic buffer overflow).

What is CWE-121?

Stack-based buffer overflow.

What is CWE-122?

Heap-based buffer overflow.

What is CWE-125?

Out-of-bounds read.

What is CWE-134?

Uncontrolled format string.

What is CWE-787?

Out-of-bounds write.

What is a format string attack?

An attack in which an attacker controls a formatting string used by functions such as printf() or scanf().

What can an attacker gain from a format string attack?

They may expose secret data or cause excessive output or buffer overflows.

What is a double-free error?

Calling a free operation on the same argument more than once.

Which languages are identified as especially common for buffer overflows?

C, C++, and Objective-C.

How can buffer overflows affect a program?

They can cause crashes, corrupt data, or allow an attacker to control execution