975
programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by
ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming
revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as
Boost.
Phase: Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Phase: Architecture and Design
Phase: Build and Compilation
The Boehm-Demers-Weiser Garbage Collector or valgrind can be used to detect leaks in code.
Demonstrative Examples
Example 1:
The following C function leaks a block of allocated memory if the call to read() does not return the
expected number of bytes:
Example Language: C (Bad)
char* getBlock(int fd) {
char* buf = (char*) malloc(BLOCK_SIZE);
if (!buf) {
return NULL;
}
if (read(fd, buf, BLOCK_SIZE) != BLOCK_SIZE) {
return NULL;
}
return buf;
}
Observed Examples
Reference Description
CVE-2005-3119 Memory leak because function does not free() an element of a data structure.
https://www.cve.org/CVERecord?id=CVE-2005-3119
CVE-2004-0427 Memory leak when counter variable is not decremented.
https://www.cve.org/CVERecord?id=CVE-2004-0427
CVE-2002-0574 chain: reference count is not decremented, leading to memory leak in OS by
sending ICMP packets.
https://www.cve.org/CVERecord?id=CVE-2002-0574
CVE-2005-3181 Kernel uses wrong function to release a data structure, preventing data from
being properly tracked by other code.
https://www.cve.org/CVERecord?id=CVE-2005-3181
CVE-2004-0222 Memory leak via unknown manipulations as part of protocol test suite.
https://www.cve.org/CVERecord?id=CVE-2004-0222
CVE-2001-0136 Memory leak via a series of the same command.
https://www.cve.org/CVERecord?id=CVE-2001-0136
Functional Areas
• Memory Management
Affected Resources
• Memory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')
CWE-402: Transmission of Private Resources
into a New Sphere ('Resource Leak') 976
Nature Type ID Name Page
MemberOf 398 7PK - Code Quality 700 2323
MemberOf 730 OWASP Top Ten 2004 Category A9 - Denial of Service 711 2339
MemberOf 861 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 18 - Miscellaneous (MSC)
844 2370
MemberOf 1152 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 49. Miscellaneous (MSC)
1133 2453
MemberOf 1162 SEI CERT C Coding Standard - Guidelines 08. Memory
Management (MEM)
1154 2458
MemberOf 1238 SFP Primary Cluster: Failure to Release Memory 888 2482
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Relationship
This is often a resultant weakness due to improper handling of malformed data or early
termination of sessions.
Terminology
"memory leak" has sometimes been used to describe other kinds of issues, e.g. for information
leaks in which the contents of memory are inadvertently leaked (CVE-2003-0400 is one such
example of this terminology conflict).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Memory leak
7 Pernicious Kingdoms Memory Leak
CLASP Failure to deallocate data
OWASP Top Ten 2004 A9 CWE More Specific Denial of Service
CERT C Secure Coding MEM31-
C
Exact Free dynamically allocated memory
when no longer needed
The CERT Oracle Secure
Coding Standard for Java
(2011)
MSC04-J Do not leak memory
Software Fault Patterns SFP14 Failure to Release Resource
OMG ASCPEM ASCPEMPRF-