592
Example Language: C (Bad)
cleartext_buffer = get_secret();...
cleartext_buffer = realloc(cleartext_buffer, 1024);
...
scrub_memory(cleartext_buffer, 1024);
There is an attempt to scrub the sensitive data from memory, but realloc() is used, so it could
return a pointer to a different part of memory. The memory that was originally allocated for
cleartext_buffer could still contain an uncleared copy of the data.
Observed Examples
Reference Description
CVE-2019-3733 Cryptography library does not clear heap memory before release
https://www.cve.org/CVERecord?id=CVE-2019-3733
Affected Resources
• Memory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 227 7PK - API Abuse 700 2313
MemberOf 742 CERT C Secure Coding Standard (2008) Chapter 9 -
Memory Management (MEM)
734 2345
MemberOf 876 CERT C++ Secure Coding Section 08 - Memory
Management (MEM)
868 2376
MemberOf 884 CWE Cross-section 884 2567
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Heap Inspection
CERT C Secure Coding MEM03-
C
Clear sensitive information stored in
reusable resources returned for reuse
Software Fault Patterns SFP23 Exposed Data
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-245: J2EE Bad Practices: Direct Management of Connections
Weakness ID : 245
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-245: J2EE Bad Practices: Direct Management of Connections
CWE-245: J2EE Bad Practices: Direct Management of Connections