2211
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Stack Exhaustion : When a weakness allocates excessive memory on the stack, it is often
described as "stack exhaustion," which is a technical impact of the weakness. This technical impact
is often encountered as a consequence of CWE-789 and/or CWE-1325.
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (Memory)
Not controlling memory allocation can result in a request
for too much system memory, possibly leading to a crash
of the application due to out-of-memory conditions, or the
consumption of a large amount of memory on the system.
Potential Mitigations
Phase: Implementation
Ensure multiple allocations of the same kind of object are properly tracked - possibly across
multiple sessions, requests, or messages. Define an appropriate strategy for handling requests
that exceed the limit, and consider supporting a configuration option so that the administrator can
extend the amount of memory to be used if necessary.
Phase: Operation
Run the program using system-provided resource limits for memory. This might still cause the
program to crash or exit, but the impact to the rest of the system will be minimized.
Demonstrative Examples
Example 1:
This example contains a small allocation of stack memory. When the program was first
constructed, the number of times this memory was allocated was probably inconsequential and
presented no problem. Over time, as the number of objects in the database grow, the number of
allocations will grow - eventually consuming the available stack, i.e. "stack exhaustion." An attacker
who is able to add elements to the database could cause stack exhaustion more rapidly than
assumed by the developer.
Example Language: C (Bad)
// Gets the size from the number of objects in a database, which over time can conceivably get very large
int end_limit = get_nmbr_obj_from_db();
int i;
int *base = NULL;
int *p =base;
for (i = 0; i < end_limit; i++)
{
*p = alloca(sizeof(int *)); // Allocate memory on the stack
p = *p; // // Point to the next location to be saved
}
Since this uses alloca(), it allocates memory directly on the stack. If end_limit is large enough, then
the stack can be entirely consumed.
Observed Examples
CWE Version 4.14
CWE-1326: Missing Immutable Root of Trust in Hardware
CWE-1326: Missing Immutable Root of Trust in Hardware