2249
{
int r2 = fclose(f); // Double close
f_flg = 0;
printf("2 close done '%d'\n", r2);
}
}
Example 2:
The following code shows a simple example of a double free vulnerability.
Example Language: C (Bad)
char* ptr = (char*)malloc (SIZE);
...
if (abrt) {
free(ptr);
}
...
free(ptr);
Double free vulnerabilities have two common (and sometimes overlapping) causes:
• Error conditions and other exceptional circumstances
• Confusion over which part of the program is responsible for freeing the memory
Although some double free vulnerabilities are not much more complicated than this example,
most are spread out across hundreds of lines of code or even different files. Programmers seem
particularly susceptible to freeing global variables more than once.
Observed Examples
Reference Description
CVE-2019-13351 file descriptor double close can cause the wrong file to be associated with a file
descriptor.
https://www.cve.org/CVERecord?id=CVE-2019-13351
CVE-2006-5051 Chain: Signal handler contains too much functionality (CWE-828), introducing
a race condition that leads to a double free (CWE-415).
https://www.cve.org/CVERecord?id=CVE-2006-5051
CVE-2004-0772 Double free resultant from certain error conditions.
https://www.cve.org/CVERecord?id=CVE-2004-0772
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Notes
Terminology
The terms related to "release" may vary depending on the type of resource, programming
language, specification, or framework. "Close" has been used synonymously for the release of
resources like file descriptors and file handles. "Return" is sometimes used instead of Release.
"Free" is typically used when releasing memory or buffers back into the system for reuse.
References
[REF-1198]"close - Perldoc Browser". < https://perldoc.perl.org/functions/close >.
CWE Version 4.14
CWE-1342: Information Exposure through Microarchitectural State after Transient Execution
CWE-1342: Information Exposure through
Microarchitectural State after Transient Execution 2250
[REF-1199]"io - Core tools for working with streams — Python 3.9.7 documentation". 2021
September 2. < https://docs.python.org/3.9/library/io.html#io.IOBase.close >.
[REF-1200]"FileOutputStream (Java Platform SE 7 )". 2020. < https://docs.oracle.com/javase/7/
docs/api/java/io/FileOutputStream.html >.
[REF-1201]"FileOutputStream (Java SE 11 & JDK 11 )". 2021. < https://docs.oracle.com/en/java/
javase/11/docs/api/java.base/java/io/FileOutputStream.html >.
CWE-1342: Information Exposure through Microarchitectural State after
Transient Execution
Weakness ID : 1342
Structure : Simple
Abstraction : Base
Description
The processor does not properly clear microarchitectural state after incorrect microcode assists or
speculative execution, resulting in transient execution.
Extended Description
In many processor architectures an exception, mis-speculation, or microcode assist results in
a flush operation to clear results that are no longer required. This action prevents these results
from influencing architectural state that is intended to be visible from software. However, traces
of this transient execution may remain in microarchitectural buffers, resulting in a change in
microarchitectural state that can expose sensitive information to an attacker using side-channel
analysis. For example, Load Value Injection (LVI) [REF-1202] can exploit direct injection of
erroneous values into intermediate load and store buffers.
Several conditions may need to be fulfilled for a successful attack:
1. incorrect transient execution that results in remanence of sensitive information;
2. attacker has the ability to provoke microarchitectural exceptions;
3. operations and structures in victim code that can be exploited must be identified.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 226 Sensitive Information in Resource Not Removed Before
Reuse