Basic questions about a buffer overflow attack example

Question

People say buffer overflows are serious security bugs that can usually be exploited. Here is an artificial buffer overflow

#include <stdio.h>

int main(){
    int a[3]={0,1,2};
    printf("value = %d\n",a[10]);      

}

I have two basic questions:

1. Does "exploit the buffer overflow" mean to change the code? If so, how to change the code above to make an attack?
2. What if the code is read-only? Can attackers still do something?

Answer 1

1)exploit can be weather you make the program stack or edit the return address using rop which make the program return to function it shouldn't go to , or change the all control flow of program by editing the set jump buffer (jop) ,or even just editing buffer you shouldn't edit etc. please

search on the attack I mention .

2)well there is some defense for this attacks nut the best one is just use code that doesn't allow the user/hacker insert more data then the buffer size .

3)I think your code may not crash the idea is that the user may insert more data then the buffer can hold so the data leaks to other location in the stack, some how it not have to be obvious like reading data from stdin but this is the most common example when you reading data from stdin without check the size of the data you read

Answer 2

In order for a buffer overflow to occur, you would need to have a buffer that an attacker can input data into while exceeding the intended size of the buffer. The example code you shared does not contain a buffer overflow, but rather a memory leak/information disclosure vulnerability. When running the program, it will print out contents of the stack beyond your array, or potentially crash if it reads completely past the stack's memory region. Without any other functionality in the program, there is nothing to exploit; such a leak may be useful for defeating exploit mitigations but it is no good on its own.

The actual code segment that is loaded into memory is generally read-only, so most attacks do not involve trying to change it. Instead, attacks will redirect program execution to memory the attacker can write to, or reuse legitimate parts of the code to perform arbitrary actions.