Potential format string vulnerability in syslog call

Description

Format string vulnerabilities allow an attacker to read or in some cases, potentially write data to and from locations in the processes' memory. To prevent against format string attacks, do not allow users or un-validated input to provide the format specification. Consider using a constant for the format specification, or strip all format specifiers from the input prior to calling the `syslog` function.

Examples

Insecure Code

syslog(LOG_INFO, user_input);

Secure Code

syslog(LOG_INFO, "Constant format string: %s", user_input);

Remediation

Use a constant format string or validate and sanitize user input to prevent format string attacks.

Rule Details

Field	Value
ID	CODE-0592
Category	Injection
Severity	HIGH
CWE	CWE-134
Confidence	HIGH
Impact	HIGH
Likelihood	MEDIUM
Exploitability	MODERATE
Tags	format string vulnerability, injection
OWASP	A1:2017-Injection, A03:2021-Injection

---