1631
Alternate Terms
File Descriptor Exhaustion :
Likelihood Of Exploit
Low
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could
prevent all other processes from accessing the same type
of resource.
Potential Mitigations
Phase: Operation
Phase: Architecture and Design
Strategy = Resource Limitation
Use resource-limiting settings provided by the operating system or environment. For example,
when managing system resources in POSIX, setrlimit() can be used to set limits for certain types
of resources, and getrlimit() can determine how many resources are available. However, these
functions are not available on all operating systems. When the current levels get close to the
maximum that is defined for the application (see CWE-770), then limit the allocation of further
resources to privileged users; alternately, begin releasing resources for less-privileged users.
While this mitigation may protect the system from attack, it will not necessarily stop attackers
from adversely impacting other users. Ensure that the application performs the appropriate error
checks and error handling in case resources become unavailable (CWE-703).
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 985 SFP Secondary Cluster: Unrestricted Consumption 888 2411
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP13 Unrestricted Consumption
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime
Weakness ID : 775
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime
CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime