Weakness (CWE)
CWE-401: Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
How to prevent it (3 mitigations)
-
Implementation
Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
For example, glibc in Linux provides protection against free of invalid pointers.
When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Architecture and Design, Build and Compilation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
Source: MITRE CWE-401
789 results · Feed
-
High 7.5
A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnera…
-
Medium 5.5
GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the gf_isom_box_parse_ex func…
-
Medium 5.5
GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the afrt_box_read function at…
-
High 7.5
An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree …
-
Medium 5.7
containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak
containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the us…
-
Medium 5.5
GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a memory leak via the function dimC_box_read at isomed…
-
High 7.5
mod_radius in ProFTPD before 1.3.7c allows memory disclosure to RADIUS servers because it copies blocks of 16 character…
-
Medium 6.0
Missing release of memory after effective lifetime in firmware for Intel(R) SPS before versions SPS_E3_06.00.03.035.0 m…
-
Medium 5.5
GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf_list_new at utils/l…
-
Medium 5.5
GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf_odf_new_iod at odf/…
-
Medium 5.5
Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple…
-
High 7.5
open5gs v2.4.11 was discovered to contain a memory leak in the component src/upf/pfcp-path.c. This vulnerability allows…
-
High 7.5
open5gs v2.4.11 was discovered to contain a memory leak in the component ngap-handler.c. This vulnerability allows atta…
-
High 7.5
open5gs v2.4.11 was discovered to contain a memory leak in the component src/smf/pfcp-path.c. This vulnerability allows…
-
Medium 5.5
timg v1.4.4 was discovered to contain a memory leak via the function timg::QueryBackgroundColor() at /timg/src/term-que…
-
Low 3.5
Linux Kernel transport.c j1939_session_destroy memory leak
A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The id…
-
Low 2.6
Linux Kernel af_vsock.c vsock_connect memory leak
A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. The complexity of an attack is rather high. The …
-
High 7.8
An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. This flaw allo…
-
High 7.5
BIG-IP SIP vulnerability CVE-2022-41832
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, when a SIP profile is configured on a virtual server, undisclosed messages can cause an increase in memory resource …
-
High 7.5
BIG-IP iRules vulnerability CVE-2022-41624
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.2, 15.1.x before 15.1.7, 14.1.x before 14.1.5.2, and 13.1.x before 13.1.5.1, when a sideband iRule is configured on a virtual server, undisclosed traffic can cause an increase in memory resource …
-
Medium 5.5
-
Medium 6.5
An issue was discovered in Bento4 1.6.0-639. There is a memory leak in the function AP4_File::ParseStream in /Core/Ap4F…
-
Medium 6.5
An issue was discovered in Bento4 v1.6.0-639. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStre…
-
Medium 5.5
Junos OS and Junos OS Evolved: An rpd memory leak might be observed while running a specific cli command in a RIB sharding scenario
An Allocation of Resources Without Limits or Throttling and a Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated low privileged…
-
High 7.5
A vulnerability found in jasper. This security vulnerability happens because of a memory leak bug in function cmdopts_p…
-
Medium 5.5
An issue was discovered in Bento4 1.6.0-639. A memory leak exists in AP4_StdcFileByteStream::Create(AP4_FileByteStream*…
-
Medium 6.0
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driv…
-
High 7.5
Memory leaks in EdDSA DNSSEC verification code
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
-
High 7.5
Memory leak in ECDSA DNSSEC verification code
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
-
High 7.5
Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.
-
Medium 5.5
SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c.
-
Low 2.3
Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated …
-
Unscored —
A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, ASAN detect…
-
Unscored —
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the se…
-
High 7.5
Undertow vulnerable to memory exhaustion due to buffer leak
A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.
-
Unscored —
A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this …
-
Unscored —
The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory…
-
Unscored —
The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory…
-
Unscored —
A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table pe…
-
Unscored —
A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the A…