Arbitrary Write Detection
Detection Workflow
- Identify write operations: Find all array writes, pointer dereference writes, format string usage with %n, struct member writes
- Trace input sources: Use
xrefs_to to trace input, follow user data to write points, identify attacker-controlled values
- Check bounds validation: Verify array bounds checks, assess pointer arithmetic safety, check format string validation, review type safety
- Assess exploitability: Can attacker control write address? Can attacker control write value? What can be overwritten? Can code execution be achieved?
Key Patterns
- Unchecked array indexing: array writes with user-controlled indices, pointer arithmetic writes with user input
- Format string writes: user-controlled format strings with %n, memory writes via printf
- Pointer dereference writes: writing through user-controlled pointers, use-after-free writes, vtable corruption
- Struct/class member writes: writing to wrong struct members, type confusion, vtable/function pointer overwrites
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, write operation, array base, index source, value source, bounds check, exploitable, attack scenario, potential targets, mitigation.
Severity Guidelines
- CRITICAL: Arbitrary write enabling code execution
- HIGH: Arbitrary write with significant impact
- MEDIUM: Arbitrary write with limited impact
- LOW: Minor arbitrary write issues
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-arbitrary-write3description: Detects arbitrary write vulnerabilities by identifying unchecked array indexing and out-of-bounds memory writes. Use when analyzing memory write operations, pointer arithmetic, or investigating code execution vulnerabilities.4---5
6# Arbitrary Write Detection
7
8## Detection Workflow
9
101. **Identify write operations**: Find all array writes, pointer dereference writes, format string usage with %n, struct member writes
112. **Trace input sources**: Use `xrefs_to` to trace input, follow user data to write points, identify attacker-controlled values
123. **Check bounds validation**: Verify array bounds checks, assess pointer arithmetic safety, check format string validation, review type safety
134. **Assess exploitability**: Can attacker control write address? Can attacker control write value? What can be overwritten? Can code execution be achieved?
14
15## Key Patterns
16
17- Unchecked array indexing: array writes with user-controlled indices, pointer arithmetic writes with user input
18- Format string writes: user-controlled format strings with %n, memory writes via printf
19- Pointer dereference writes: writing through user-controlled pointers, use-after-free writes, vtable corruption
20- Struct/class member writes: writing to wrong struct members, type confusion, vtable/function pointer overwrites
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, vulnerability, write operation, array base, index source, value source, bounds check, exploitable, attack scenario, potential targets, mitigation.
25
26## Severity Guidelines
27
28- **CRITICAL**: Arbitrary write enabling code execution
29- **HIGH**: Arbitrary write with significant impact
30- **MEDIUM**: Arbitrary write with limited impact
31- **LOW**: Minor arbitrary write issues
32
33## See Also
34
35- `patterns.md` - Detailed detection patterns and exploitation scenarios
36- `examples.md` - Example analysis cases and code samples
37- `references.md` - CWE references and mitigation strategies
aibot88