Skip to content
OpenAdvisories

Weakness (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

Variant Draft

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

How to prevent it (3 mitigations)

  1. Implementation

    Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.

    For example, glibc in Linux provides protection against free of invalid pointers.

    When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].

    To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.

  2. Architecture and Design

    Use an abstraction library to abstract away risky APIs. Not a complete solution.

  3. Architecture and Design, Build and Compilation

    Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.

Source: MITRE CWE-401

All Critical High Medium Low Exploited only Public exploit

84 results · Clear filters · Feed

  • Low 3.5
    CVE-2022-3633

    Linux Kernel transport.c j1939_session_destroy memory leak

    A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The id…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Low 2.6
    CVE-2022-3629

    Linux Kernel af_vsock.c vsock_connect memory leak

    A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. The complexity of an attack is rather high. The …

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Low 2.3
    CVE-2022-31222

    Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated …

    Dell CPG BIOS
  • Low 3.3
    CVE-2019-3815

    A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch…

    The systemd Project systemd