1632
The product does not release a file descriptor or handle after its effective lifetime has ended, i.e.,
after the file descriptor/handle is no longer needed.
Extended Description
When a file descriptor or handle is not released after use (typically by explicitly closing it), attackers
can cause a denial of service by consuming all available file descriptors/handles, or otherwise
preventing other system processes from obtaining their own file descriptors/handles.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 772 Missing Release of Resource after Effective Lifetime 1624
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
Nature Type ID Name Page
ChildOf 404 Improper Resource Shutdown or Release 980
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 404 Improper Resource Shutdown or Release 980
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (Other)
An attacker that can influence the allocation of resources
that are not properly released could deplete the available
resource pool and prevent all other processes from
accessing the same type of resource.
Potential Mitigations
Phase: Operation
Phase: Architecture and Design
Strategy = Resource Limitation
Use resource-limiting settings provided by the operating system or environment. For example,
when managing system resources in POSIX, setrlimit() can be used to set limits for certain types
of resources, and getrlimit() can determine how many resources are available. However, these
functions are not available on all operating systems. When the current levels get close to the
maximum that is defined for the application (see CWE-770), then limit the allocation of further
resources to privileged users; alternately, begin releasing resources for less-privileged users.
While this mitigation may protect the system from attack, it will not necessarily stop attackers
from adversely impacting other users. Ensure that the application performs the appropriate error
checks and error handling in case resources become unavailable (CWE-703).
Observed Examples
Reference Description
CVE-2007-0897 Chain: anti-virus product encounters a malformed file but returns from a
function without closing a file descriptor (CWE-775) leading to file descriptor
consumption (CWE-400) and failed scans.
https://www.cve.org/CVERecord?id=CVE-2007-0897
CWE Version 4.14
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-776: Improper Restriction of Recursive Entity
References in DTDs ('XML Entity Expansion')