1631
Weakness Ordinalities
Primary : Improper release or shutdown of resources can be primary to resource
exhaustion, performance, and information confidentiality problems to name a few.
Resultant : Improper release or shutdown of resources can be resultant from improper error
handling or insufficient resource tracking.
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Availability
Other
DoS: Resource Consumption (Other)
Varies by Context
Most unreleased resource issues result in general software
reliability problems, but if an attacker can intentionally
trigger a resource leak, the attacker might be able to
launch a denial of service attack by depleting the resource
pool.
Confidentiality Read Application Data
When a resource containing sensitive information is not
correctly shutdown, it may expose the sensitive data in a
subsequent allocation.
Detection Methods
Automated Dynamic Analysis
This weakness can be detected using dynamic tools and techniques that interact with the
software using large test suites with many diverse inputs, such as fuzz testing (fuzzing),
robustness testing, and fault injection. The software's operation may slow down, but it should
not become unstable, crash, or generate incorrect results. Resource clean up errors might be
detected with a stress-test by calling the software simultaneously from a large number of threads
or processes, and look for evidence of any unexpected behavior. The software's operation may
slow down, but it should not become unstable, crash, or generate incorrect results.
Effectiveness = Moderate
Manual Dynamic Analysis
Identify error conditions that are not likely to occur during normal usage and trigger them.
For example, run the product under low memory conditions, run with insufficient privileges
or permissions, interrupt a transaction before it is completed, or disable connectivity to basic
network services such as DNS. Monitor the software for any unexpected behavior. If you trigger
an unhandled exception or similar error that was discovered and handled by the application's
environment, it may still indicate unexpected conditions that were not handled by the application
itself.
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
CWE Version 4.14
CWE-404: Improper Resource Shutdown or Release
CWE-404: Improper Resource Shutdown or Release