Buffer Overflow

An advanced exploitation technique that bypasses non-executable memory defenses by chaining together existing code snippets (gadgets) already present in the program's memory. Instead of injecting new malicious code, an attacker manipulates the call stack to execute a sequence of instructions ending in a ret instruction, effectively weaponizing the application's own legitimate code against itself. This is the dominant method for exploiting buffer overflows on modern systems with Data Execution Prevention (DEP) enabled.

A runtime security mechanism that places a random secret value (the canary) on the stack just before the return address. Before a function returns, the canary is verified; if a buffer overflow has overwritten it, the program terminates immediately to prevent control-flow hijacking.

• Terminator canaries: Use null bytes to block string-based overflows
• Random canaries: Stored in a global variable, harder to leak
• Random XOR canaries: XORed with control data for extra protection

A defensive technique that randomizes the memory addresses of key process areas—stack, heap, libraries—each time a program executes. This forces an attacker to first leak a memory address before crafting a reliable exploit, significantly raising the bar for successful exploitation. In AI systems, ASLR protects inference servers and model-serving runtimes from predictable memory layouts that would make buffer overflow attacks trivially reproducible.

A hardware and software security feature that marks memory regions as non-executable, preventing injected shellcode from running on the stack or heap. DEP forces attackers to rely on code-reuse techniques like Return-Oriented Programming rather than direct code injection. Modern AI serving runtimes depend on DEP to protect against buffer overflows that attempt to execute malicious payloads in model input buffers.

An exploitation technique where an attacker allocates large amounts of memory and fills it with malicious payloads (often NOP sleds + shellcode) at predictable addresses. When combined with a buffer overflow that corrupts a function pointer, execution can be redirected into the sprayed heap region. This technique is particularly relevant to JavaScript-based AI frontends and WebAssembly runtimes where precise memory layout control is achievable.

A related memory corruption bug where user-controlled input is passed directly to a printf-style formatting function without proper sanitization. Attackers use format specifiers like %x to leak stack memory and %n to write arbitrary values to arbitrary addresses. While distinct from buffer overflows, format string bugs are often chained with them to bypass ASLR by leaking memory addresses before triggering the overflow.