567
Functional Areas
• Memory Management
• Networking
Affected Resources
• Memory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 729 OWASP Top Ten 2004 Category A8 - Insecure Storage 711 2338
MemberOf 742 CERT C Secure Coding Standard (2008) Chapter 9 -
Memory Management (MEM)
734 2345
MemberOf 876 CERT C++ Secure Coding Section 08 - Memory
Management (MEM)
868 2376
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1202 Memory and Storage Issues 1194 2472
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Relationship
There is a close association between CWE-226 and CWE-212. The difference is partially that
of perspective. CWE-226 is geared towards the final stage of the resource lifecycle, in which
the resource is deleted, eliminated, expired, or otherwise released for reuse. Technically, this
involves a transfer to a different control sphere, in which the original contents of the resource
are no longer relevant. CWE-212, however, is intended for sensitive data in resources that
are intentionally shared with others, so they are still active. This distinction is useful from the
perspective of the CWE research view (CWE-1000).
Maintenance
This entry needs modification to clarify the differences with CWE-212. The description also
combines two problems that are distinct from the CWE research perspective: the inadvertent
transfer of information to another sphere, and improper initialization/shutdown. Some of the
associated taxonomy mappings reflect these different uses.
Research Gap
This is frequently found for network packets, but it can also exist in local memory allocation, files,
etc.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Sensitive Information Uncleared Before
Use
CERT C Secure Coding MEM03-
C
Clear sensitive information stored in
reusable resources returned for reuse
Software Fault Patterns SFP23 Exposed Data
Related Attack Patterns
CAPEC-ID Attack Pattern Name
37 Retrieve Embedded Sensitive Data
References
CWE Version 4.14
CWE-228: Improper Handling of Syntactically Invalid Structure
CWE-228: Improper Handling of Syntactically Invalid Structure