1625
Nature Type ID Name Page
MemberOf 399 Resource Management Errors 2324
Applicable Platforms
Technology : Mobile (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (Other)
An attacker that can influence the allocation of resources
that are not properly released could deplete the available
resource pool and prevent all other processes from
accessing the same type of resource.
Potential Mitigations
Phase: Requirements
Strategy = Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make
this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform
automatic garbage collection that releases memory for objects that have been deallocated.
Phase: Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent
with how and where you free resources in a function. If you allocate resources that you intend to
free upon completion of the function, you must be sure to free the resources at all exit points for
that function including error conditions.
Phase: Operation
Phase: Architecture and Design
Strategy = Resource Limitation
Use resource-limiting settings provided by the operating system or environment. For example,
when managing system resources in POSIX, setrlimit() can be used to set limits for certain types
of resources, and getrlimit() can determine how many resources are available. However, these
functions are not available on all operating systems. When the current levels get close to the
maximum that is defined for the application (see CWE-770), then limit the allocation of further
resources to privileged users; alternately, begin releasing resources for less-privileged users.
While this mitigation may protect the system from attack, it will not necessarily stop attackers
from adversely impacting other users. Ensure that the application performs the appropriate error
checks and error handling in case resources become unavailable (CWE-703).
Demonstrative Examples
Example 1:
The following method never closes the new file handle. Given enough time, the Finalize() method
for BufferReader should eventually call Close(), but there is no guarantee as to how long this action
will take. In fact, there is no guarantee that Finalize() will ever be invoked. In a busy environment,
the Operating System could use up all of the available file handles before the Close() function is
called.
Example Language: Java (Bad)
private void processFile(string fName)
CWE Version 4.14
CWE-772: Missing Release of Resource after Effective Lifetime
CWE-772: Missing Release of Resource after Effective Lifetime