1600
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 404 Improper Resource Shutdown or Release 980
ParentOf 761 Free of Pointer not at Start of Buffer 1592
ParentOf 762 Mismatched Memory Management Routines 1596
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 404 Improper Resource Shutdown or Release 980
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 404 Improper Resource Shutdown or Release 980
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 399 Resource Management Errors 2324
MemberOf 465 Pointer Issues 2328
Common Consequences
Scope Impact Likelihood
Integrity
Availability
Confidentiality
Modify Memory
DoS: Crash, Exit, or Restart
Execute Unauthorized Code or Commands
This weakness may result in the corruption of memory,
and perhaps instructions, possibly leading to a crash. If the
corrupted memory can be effectively controlled, it may be
possible to execute arbitrary code.
Detection Methods
Fuzzing
Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs
- either randomly or algorithmically - and dynamically invoking the code with those inputs.
Even with random inputs, it is often capable of generating unexpected results such as crashes,
memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases
that clearly indicate bugs, which helps developers to diagnose the issues.
Effectiveness = High
Potential Mitigations
Phase: Implementation
Only call matching memory management functions. Do not mix and match routines. For example,
when you allocate a buffer with malloc(), dispose of the original pointer with free().
Phase: Implementation
When programming in C++, consider using smart pointers provided by the boost library to help
correctly and consistently manage memory.
Phase: Architecture and Design
Strategy = Libraries or Frameworks
CWE Version 4.14
CWE-763: Release of Invalid Pointer or Reference
CWE-763: Release of Invalid Pointer or Reference