979
Observed Examples
Reference Description
CVE-2003-0740 Server leaks a privileged file descriptor, allowing the server to be hijacked.
https://www.cve.org/CVERecord?id=CVE-2003-0740
CVE-2004-1033 File descriptor leak allows read of restricted files.
https://www.cve.org/CVERecord?id=CVE-2004-1033
CVE-2000-0094 Access to restricted resource using modified file descriptor for stderr.
https://www.cve.org/CVERecord?id=CVE-2000-0094
CVE-2002-0638 Open file descriptor used as alternate channel in complex race condition.
https://www.cve.org/CVERecord?id=CVE-2002-0638
CVE-2003-0489 Program does not fully drop privileges after creating a file descriptor, which
allows access to the descriptor via a separate vulnerability.
https://www.cve.org/CVERecord?id=CVE-2003-0489
CVE-2003-0937 User bypasses restrictions by obtaining a file descriptor then calling setuid
program, which does not close the descriptor.
https://www.cve.org/CVERecord?id=CVE-2003-0937
CVE-2004-2215 Terminal manager does not properly close file descriptors, allowing attackers
to access terminals of other users.
https://www.cve.org/CVERecord?id=CVE-2004-2215
CVE-2006-5397 Module opens a file for reading twice, allowing attackers to read files.
https://www.cve.org/CVERecord?id=CVE-2006-5397
Affected Resources
• System Process
• File or Directory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER UNIX file descriptor leak
CERT C Secure Coding FIO42-C Ensure files are properly closed when
they are no longer needed
Software Fault Patterns SFP23 Exposed Data
References
[REF-392]Paul Roberts. "File descriptors and setuid applications". 2007 February 5. < https://
blogs.oracle.com/paulr/entry/file_descriptors_and_setuid_applications >.
[REF-393]Apple. "Introduction to Secure Coding Guide". < https://developer.apple.com/library/
archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/AccessControl.html
>.2023-04-07.
CWE Version 4.14
CWE-404: Improper Resource Shutdown or Release
CWE-404: Improper Resource Shutdown or Release