Common Software Vulnerabilities

Common Software Vulnerabilities

1. Buffer Overflow

   • Defense
     • Compile Time Defense
       • Canary
       • RAD
     • Run Time Defense
       • Guard Memory Pages
       • ASLR
       • Non-Executable Address Spaces
   • Type
     • Stack Overflow
     • Heap Overflow
     • Integer Overflow
     • Global Data Overflow
     • Exploitation Code Execution

2. Injection Attack

   • Defense
     • Validate Input
     • Filter Out Sensitive Data
     • Only Accept Trusted Objects
     • Do Not Deserialize Objects
   • Type
     • Regex Injection
     • Format Strings
     • Object Deserialization

3. All Input Is Evil

   • Sanitization
   • Validation
   • Canonicalization
   • Regular Expression
   • Normalization
   • Input Fuzzing

4. Race Condition

   • Type
     • Time-of-Check to Time-of-Use
     • Dirty COW
   • Defense
     • Make Code Atomic
     • Use Critical Sections
       • Mutexes
       • Semaphores
     • Principle of Least Privilege