1733
Scope Impact Likelihood
If the expired pointer is used in a read operation, an
attacker might be able to control data read in by the
application.
Availability DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is
not accessible to the product, or points to a location that is
"malformed" (such as NULL) or larger than expected by a
read or write operation, then a crash may occur.
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to
unexpected data in a write operation, then code execution
may be possible.
Potential Mitigations
Phase: Architecture and Design
Choose a language that provides automatic memory management.
Phase: Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization
of multiple or complex data structures may lower the usefulness of this strategy.
Demonstrative Examples
Example 1:
The following code shows a simple example of a use after free error:
Example Language: C (Bad)
char* ptr = (char*)malloc (SIZE);
if (err) {
abrt = 1;
free(ptr);
}
...
if (abrt) {
logError("operation aborted before commit", ptr);
}
When an error occurs, the pointer is immediately freed. However, this pointer is later incorrectly
used in the logError function.
Example 2:
The following code shows a simple example of a double free error:
Example Language: C (Bad)
char* ptr = (char*)malloc (SIZE);
...
if (abrt) {
free(ptr);
}
...
free(ptr);
Double free vulnerabilities have two common (and sometimes overlapping) causes:
• Error conditions and other exceptional circumstances
• Confusion over which part of the program is responsible for freeing the memory
CWE Version 4.14
CWE-826: Premature Release of Resource During Expected Lifetime
CWE-826: Premature Release of Resource During Expected Lifetime