2247
Nature Type ID Name Page
ParentOf 415 Double Free 1008
CanPrecede 672 Operation on a Resource after Expiration or Release 1479
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 399 Resource Management Errors 2324
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Language : Rust (Prevalence = Undetermined)
Language : Not Language-Specific (Prevalence = Undetermined)
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability
Integrity
DoS: Crash, Exit, or Restart Medium
Detection Methods
Automated Static Analysis
For commonly-used APIs and resource types, automated tools often have signatures that can
spot this issue.
Automated Dynamic Analysis
Some compiler instrumentation tools such as AddressSanitizer (ASan) can indirectly detect some
instances of this weakness.
Potential Mitigations
Phase: Implementation
Change the code's logic so that the resource is only closed once. This might require simplifying
or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple
closes are buried within complex conditionals.
Phase: Implementation
Strategy = Refactoring
It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared
when it is closed, and (3) checked before closing. This approach can be useful when there are
disparate cases in which closes must be performed. However, flag-tracking can increase code
complexity and requires diligent compliance by the programmer.
Phase: Implementation
Strategy = Refactoring
When closing a resource, set the resource's associated variable to NULL or equivalent value for
the given language. Some APIs will ignore this null value without causing errors. For other APIs,
this can lead to application crashes or exceptions, which may still be preferable to corrupting an
unintended resource such as memory or data.
CWE Version 4.14
CWE-1341: Multiple Releases of Same Resource or Handle
CWE-1341: Multiple Releases of Same Resource or Handle