1735
the appropriate time, but it maintains a reference to the resource, which it later accesses. For this
weakness, the resource should still be valid upon the subsequent access.
When a product releases a resource that is still being used, it is possible that operations will still
be taken on this resource, which may have been repurposed in the meantime, leading to issues
similar to CWE-825. Consequences may include denial of service, information exposure, or code
execution.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 666 Operation on Resource in Wrong Phase of Lifetime 1462
CanPrecede 672 Operation on a Resource after Expiration or Release 1479
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 399 Resource Management Errors 2324
MemberOf 840 Business Logic Errors 2360
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Read Memory
If the released resource is subsequently reused or
reallocated, then a read operation on the original resource
might access sensitive data that is associated with a
different user or entity.
Availability DoS: Crash, Exit, or Restart
When the resource is released, the software might modify
some of its structure, or close associated channels (such
as a file descriptor). When the software later accesses the
resource as if it is valid, the resource might not be in an
expected state, leading to resultant errors that may lead to
a crash.
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
Modify Application Data
Modify Memory
When the resource is released, the software might modify
some of its structure. This might affect logic in the sections
of code that still assume the resource is active. If the
released resource is related to memory and is used in
a function call, or points to unexpected data in a write
operation, then code execution may be possible upon
subsequent accesses.
Observed Examples
Reference Description
CVE-2009-3547 Chain: race condition (CWE-362) might allow resource to be released before
operating on it, leading to NULL dereference (CWE-476)
CWE Version 4.14
CWE-827: Improper Control of Document Type Definition
CWE-827: Improper Control of Document Type Definition