Buffer Overflow
Noun · Security & Infosec · Origin: 1988
Definitions
Buffer Overflow is a vulnerability that occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to overwrite adjacent memory. This can corrupt data, crash the program, or allow an attacker to execute arbitrary code by overwriting control data such as return addresses on the stack. Stack-based buffer overflows overwrite the function return address to redirect execution to attacker-controlled code. Heap-based overflows corrupt dynamically allocated memory structures. Buffer overflows have been responsible for some of the most devastating security exploits in computing history, including the Morris Worm (1988) and Code Red (2001). Defenses include bounds checking, stack canaries, address space layout randomization (ASLR), non-executable stack (DEP/NX), and using memory-safe languages like Rust that prevent these errors at compile time. C and C++ remain particularly susceptible because they perform no automatic bounds checking on array accesses.
In plain English: When a program tries to store more data than a container can hold, the extra spills into neighboring memory — and an attacker can craft that spillover to take control of the computer.
Example: "The Morris Worm exploited a buffer overflow in fingerd. Thirty-five years later we still haven't learned."
The Morris Worm (1988), Code Red (2001), and Heartbleed (2014) all exploited buffer overflows. Memory-safe languages like Rust eliminate this class of vulnerability entirely, which is why major projects are gradually rewriting C/C++ components in Rust.
Example: 'We're rewriting the parser in Rust specifically to eliminate the buffer overflow vulnerabilities we keep finding in the C version.'
Source: historical impact
Etymology
- 1972
- The Computer Security Technology Planning Study for the U.S. Air Force identified buffer overruns as a security risk, one of the earliest documented warnings.
- 1988
- The Morris Worm exploited a buffer overflow in the Unix fingerd service to propagate across the early internet, infecting roughly 6,000 machines and becoming front-page news.
- 1996
- Aleph One published 'Smashing the Stack for Fun and Profit' in Phrack magazine, providing a detailed tutorial on exploiting stack-based buffer overflows and making the technique widely understood.
- 2000s-Present
- Defenses like ASLR, stack canaries, DEP/NX, and memory-safe languages (Rust) were developed in response. Buffer overflows remain a top vulnerability class in C/C++ code.
Origin Story
The bug that has been destroying software security since 1988
**Buffer overflows** became famous through the **Morris Worm** of November 2, 1988 -- one of the first internet worms, created by Robert Tappan Morris. It exploited a buffer overflow in the Unix `fingerd` program to spread across the early internet.
The vulnerability is simple: a program allocates a fixed-size buffer (say, 64 bytes) but writes more data than it can hold. The excess overwrites adjacent memory, which often includes the function's return address. An attacker can overwrite it with the address of their own malicious code.
Buffer overflows have caused billions of dollars in damage: Code Red, Slammer, Blaster, and countless other worms exploited them. The C language makes them easy to write and hard to prevent. Stack canaries, ASLR, DEP, and eventually Rust's memory safety were all responses to this single class of bug.
Coined by: Computing security community
Context: Morris Worm, November 2, 1988 (made famous)
Fun fact: Robert Morris's father, Robert Morris Sr., was the chief scientist at the NSA's National Computer Security Center at the time of the worm. The irony was not lost on anyone. Morris Jr. was convicted under the Computer Fraud and Abuse Act but later became a tenured MIT professor and Y Combinator partner.