564
Manual Analysis
Write a known pattern into each sensitive location. Trigger the release of the resource or cause
the desired state transition to occur. Read data back from the sensitive locations. If the reads are
successful, and the data is the same as the pattern that was originally written, the test fails and
the product needs to be fixed. Note that this test can likely be automated.
Effectiveness = High
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
During critical state transitions, information not needed in the next state should be removed or
overwritten with fixed patterns (such as all 0's) or random data, before the transition to the next
state.
Effectiveness = High
Phase: Architecture and Design
Phase: Implementation
When releasing, de-allocating, or deleting a resource, overwrite its data and relevant metadata
with fixed patterns or random data. Be cautious about complex resource types whose underlying
representation might be non-contiguous or change at a low level, such as how a file might be
split into different chunks on a file system, even though "logical" file positions are contiguous at
the application layer. Such resource types might require invocation of special modes or APIs
to tell the underlying operating system to perform the necessary clearing, such as SDelete
(Secure Delete) on Windows, although the appropriate functionality might not be available at the
application layer.
Effectiveness = High
Demonstrative Examples
Example 1:
This example shows how an attacker can take advantage of an incorrect state transition.
Suppose a device is transitioning from state A to state B. During state A, it can read certain private
keys from the hidden fuses that are only accessible in state A but not in state B. The device reads
the keys, performs operations using those keys, then transitions to state B, where those private
keys should no longer be accessible.
Example Language: (Bad)
During the transition from A to B, the device does not scrub the memory.
CWE Version 4.14
CWE-226: Sensitive Information in Resource Not Removed Before Reuse
CWE-226: Sensitive Information in Resource Not Removed Before Reuse