Why is printf(inputString) a security hole?

Question

I was reading an answer on Quora where I encountered that something as simple as:

char* inputString;
printf(inputString);

is a security hole.

I assume that the inputString is not simply uninitialized, but initialized with some external input between the two statements.

How exactly is this a security hole?

The original answer on Quora was here:

If C and C++ give the best performance, why do we still code in other languages?

but it provides no additional context for this claim.

Answer 1

I assume that the input string is a string you got from the user, and not just an uninitialized value.

The problem is that the user can

• crash the program: printf ("%s%s%s%s%s%s%s%s%s%s%s%s")
• view the stack: printf ("%08x %08x %08x %08x %08x\n");
• view memory on any location,
• or even write an integer to nearly any location in the process memory.

This leads to an attacker being able to:

• Overwrite important program flags that control access privileges
• Overwrite return addresses on the stack, function pointers, etc

It is all explained quite well here.

Answer 2

It's not just a security problem, but it won't work at all, because the pointer is not initialized. In this context, making the program crash = not running anymore could be a (security) problem, depending what the program does and in what context it runs.

I assume you mean you have a proper string. In this case, if the string is provided by some external input (user etc.), there can be (unexpected) placeholders like %s etc. while the rest of the printf expects eg. a %d. For this example (%s instead of %d), instead of printing an integer number, it will start printing all memory content until some 0 byte then, possibly giving out some secret information stored after the int bytes.

Something similar, ie. giving out too much bytes because of wrong unchecked user input, happened eg. in the known "Heartbleed" bug not too long ago, which was/is a pretty big global problem. ... The first printf parameter should be fixed, not coming from any variable.

Other placeholder combinations are possible too, leading to a wide range of possible effects (including generation of wrong floating point signals in the CPU, which could lead to more serious problems depending on the architecture, etc.etc.)