2043
CanFollow 410 Insufficient Resource Pool 998
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ParentOf 770 Allocation of Resources Without Limits or Throttling 1613
ParentOf 920 Improper Restriction of Power Consumption 1823
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Resource Exhaustion :
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Availability DoS: Crash, Exit, or Restart
DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
DoS: Resource Consumption (Other)
The most common result of resource exhaustion is denial
of service. The product may slow down, crash due to
unhandled errors, or lock out legitimate users.
Access Control
Other
Bypass Protection Mechanism
Other
In some cases it may be possible to force the product to
"fail open" in the event of resource exhaustion. The state of
the product -- and possibly the security functionality - may
then be compromised.
Detection Methods
Automated Static Analysis
Automated static analysis typically has limited utility in recognizing resource exhaustion
problems, except for program-independent system resources such as files, sockets,
and processes. For system resources, automated static analysis may be able to detect
circumstances in which resources are not released after they have expired. Automated analysis
of configuration files may be able to detect settings that do not specify a maximum value.
Automated static analysis tools will not be appropriate for detecting exhaustion of custom
resources, such as an intended security policy in which a bulletin board user is only allowed to
make a limited number of posts per day.
Effectiveness = Limited
Automated Dynamic Analysis
CWE Version 4.14
CWE-400: Uncontrolled Resource Consumption
CWE-400: Uncontrolled Resource Consumption