zakirkun Format String Vulnerability
Overview
Format string vulnerabilities occur when user-controlled data is passed as the format argument to printf(), sprintf(), fprintf(), etc. Attackers can:
- Read stack memory:
%x %x %x %xdumps stack values, leaking addresses and secrets - Write to arbitrary memory:
%nwrites the number of bytes printed so far to a pointer on the stack - Remote Code Execution: By writing to the GOT (Global Offset Table) or return address
Detection Strategy
Any printf-family call where the first argument (format string) comes from user input rather than a string literal.
Remediation
Always use a literal format string with user data as a parameter argument.
Vulnerable:
char buf[256];
fgets(buf, sizeof(buf), stdin);
printf(buf); // Format string vulnerability!
Safe:
char buf[256];
fgets(buf, sizeof(buf), stdin);
printf("%s", buf); // User data as argument, not format string