CVE-2023-21536

Controls whether organization resources are exposed to external system spheres by permitting or prohibiting their use.

The control ensures information is not released into a security sphere where the recipient lacks matching access authorizations.

The control ensures information resources are not exposed to the incorrect (public) sphere through review and authorization.

Protects against data mining that would expose resources to unauthorized spheres by enforcing detection and controls.

Restricts information flows to ensure resources are not exposed to incorrect or unauthorized spheres.

Accurate timestamps from internal clocks enable detection of race conditions by providing reliable event ordering in audit logs.

Controlling internal connections prevents exposure of resources to unintended internal spheres.

Knowing exact processing and storage locations helps avoid exposure of resources to incorrect spheres.

Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.

Network segmentation and unauthorized-access protections reduce the chance of resources being reachable by the wrong sphere.

Routine patching replaces vulnerable code containing out-of-bounds read flaws.

Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.

Placing systems of differing trust levels into separate domains prevents resources from being placed in a sphere where they are reachable by unintended actors.

Secure development life cycle mandates input validation and bounds checking that directly prevent out-of-bounds reads.

Application security requirements include explicit bounds and memory-safety specifications that mitigate buffer over-reads.

Secure system architecture and engineering principles require memory-safe design patterns and runtime protections against out-of-bounds access.