1734
Although some double free vulnerabilities are not much more complicated than the previous
example, most are spread out across hundreds of lines of code or even different files.
Programmers seem particularly susceptible to freeing global variables more than once.
Observed Examples
Reference Description
CVE-2008-5013 access of expired memory address leads to arbitrary code execution
https://www.cve.org/CVERecord?id=CVE-2008-5013
CVE-2010-3257 stale pointer issue leads to denial of service and possibly other consequences
https://www.cve.org/CVERecord?id=CVE-2010-3257
CVE-2008-0062 Chain: a message having an unknown message type may cause a reference
to uninitialized memory resulting in a null pointer dereference (CWE-476) or
dangling pointer (CWE-825), possibly crashing the system or causing heap
corruption.
https://www.cve.org/CVERecord?id=CVE-2008-0062
CVE-2007-1211 read of value at an offset into a structure after the offset is no longer valid
https://www.cve.org/CVERecord?id=CVE-2007-1211
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 867 2011 Top 25 - Weaknesses On the Cusp 900 2372
MemberOf 884 CWE Cross-section 884 2567
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Maintenance
There are close relationships between incorrect pointer dereferences and other weaknesses
related to buffer operations. There may not be sufficient community agreement regarding
these relationships. Further study is needed to determine when these relationships are chains,
composites, perspective/layering, or other types of relationships. As of September 2010, most of
the relationships are being captured as chains.
Terminology
Many weaknesses related to pointer dereferences fall under the general term of "memory
corruption" or "memory safety." As of September 2010, there is no commonly-used terminology
that covers the lower-level variants.
CWE-826: Premature Release of Resource During Expected Lifetime
Weakness ID : 826
Structure : Simple
Abstraction : Base
Description
The product releases a resource that is still intended to be used by itself or another actor.
Extended Description
This weakness focuses on errors in which the product should not release a resource, but performs
the release anyway. This is different than a weakness in which the product releases a resource at
CWE Version 4.14
CWE-826: Premature Release of Resource During Expected Lifetime
CWE-826: Premature Release of Resource During Expected Lifetime