1615
Scope Impact Likelihood
Availability DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could
prevent other systems, applications, or processes from
accessing the same type of resource.
Detection Methods
Manual Static Analysis
Manual static analysis can be useful for finding this weakness, but it might not achieve desired
code coverage within limited time constraints. If denial-of-service is not considered a significant
risk, or if there is strong emphasis on consequences such as code execution, then manual
analysis may not focus on this weakness at all.
Fuzzing
While fuzzing is typically geared toward finding low-level implementation bugs, it can
inadvertently find uncontrolled resource allocation problems. This can occur when the fuzzer
generates a large number of test cases but does not restart the targeted product in between test
cases. If an individual test case produces a crash, but it does not do so reliably, then an inability
to limit resource allocation may be the cause. When the allocation is directly affected by numeric
inputs, then fuzzing may produce indications of this weakness.
Effectiveness = Opportunistic
Automated Dynamic Analysis
Certain automated dynamic analysis techniques may be effective in producing side effects
of uncontrolled resource allocation problems, especially with resources such as processes,
memory, and connections. The technique may involve generating a large number of requests to
the product within a short time frame. Manual analysis is likely required to interpret the results.
Automated Static Analysis
Specialized configuration or tuning may be required to train automated tools to recognize
this weakness. Automated static analysis typically has limited utility in recognizing unlimited
allocation problems, except for the missing release of program-independent system resources
such as files, sockets, and processes, or unchecked arguments to memory. For system
resources, automated static analysis may be able to detect circumstances in which resources
are not released after they have expired, or if too much of a resource is requested at once, as
can occur with memory. Automated analysis of configuration files may be able to detect settings
that do not specify a maximum value. Automated static analysis tools will not be appropriate for
detecting exhaustion of custom resources, such as an intended security policy in which a bulletin
board user is only allowed to make a limited number of posts per day.
Potential Mitigations
Phase: Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which
behaviors are acceptable when resource allocation reaches limits.
Phase: Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for
resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Phase: Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit
the amount of resources that an unauthorized user can cause to be expended. A strong
CWE Version 4.14
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-770: Allocation of Resources Without Limits or Throttling