1012
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-416: Use After Free
Weakness ID : 416
Structure : Simple
Abstraction : Variant
Description
Referencing memory after it has been freed can cause a program to crash, use unexpected values,
or execute code.
Extended Description
The use of previously-freed memory can have any number of adverse consequences, ranging from
the corruption of valid data to the execution of arbitrary code, depending on the instantiation and
timing of the flaw. The simplest way data corruption may occur involves the system's reuse of the
freed memory. Use-after-free errors have two common and sometimes overlapping causes:
• Error conditions and other exceptional circumstances.
• Confusion over which part of the program is responsible for freeing the memory.
In this scenario, the memory in question is allocated to another pointer validly at some point after
it has been freed. The original pointer to the freed memory is used again and points to somewhere
within the new allocation. As the data is changed, it corrupts the validly used memory; this induces
undefined behavior in the process.
If the newly allocated data happens to hold a class, in C++ for example, various function pointers
may be scattered within the heap data. If one of these function pointers is overwritten with an
address to valid shellcode, execution of arbitrary code can be achieved.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 825 Expired Pointer Dereference 1732
PeerOf 415 Double Free 1008
CanFollow 364 Signal Handler Race Condition 899
CanFollow 1265 Unintended Reentrant Invocation of Non-reentrant Code Via
Nested Calls