Weakness (CWE)
CWE-404: Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
More detail
When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
How to prevent it (4 mitigations)
-
Requirements
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
-
Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
-
Implementation
Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].
-
Implementation
When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.
Source: MITRE CWE-404
209 results · Clear filters · Feed
-
Low 3.5
Linux Kernel Netfilter sysfs.c damon_sysfs_add_target memory leak
A vulnerability, which was classified as problematic, was found in Linux Kernel. Affected is the function damon_sysfs_add_target of the file mm/damon/sysfs.c of the component Netfilter. The manipulation leads to memory leak. It is recommended to apply a patch…
-
Low 3.5
X.org Server xkb.c ProcXkbGetKbdByName memory leak
A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue…
-
Low 3.5
Linux Kernel BPF usdt.c parse_usdt_arg memory leak
A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommende…
-
Low 3.5
Open5GS UDP Packet ogs-tlv-msg.c denial of service
A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library lib/core/ogs-tlv-msg.c of the component UDP Packet Handler. The manipulation leads to denial of service. The exploit h…
-
Low 2.8
WEKA INTEREST Security Scanner LAN Viewer denial of service
A vulnerability, which was classified as problematic, was found in WEKA INTEREST Security Scanner up to 1.8. This affects an unknown part of the component LAN Viewer. The manipulation with an unknown input leads to denial of service. Attacking locally is a re…
-
Low 2.8
WEKA INTEREST Security Scanner Webspider denial of service
A vulnerability, which was classified as problematic, has been found in WEKA INTEREST Security Scanner up to 1.8. Affected by this issue is some unknown functionality of the component Webspider. The manipulation with an unknown input leads to denial of servic…
-
Low 2.8
WEKA INTEREST Security Scanner Stresstest Configuration denial of service
A vulnerability classified as problematic was found in WEKA INTEREST Security Scanner up to 1.8. Affected by this vulnerability is the Stresstest Configuration Handler. A manipulation leads to a local denial of service. The exploit has been disclosed to the p…
-
Low 2.8
WEKA INTEREST Security Scanner Stresstest Scheme denial of service
A vulnerability classified as problematic has been found in WEKA INTEREST Security Scanner up to 1.8. Affected is Stresstest Scheme Handler which leads to a denial of service. The attack needs to be approached locally. The exploit has been disclosed to the pu…
-
Low 2.8
WEKA INTEREST Security Scanner HTTP denial of service
A vulnerability was found in WEKA INTEREST Security Scanner 1.8. It has been rated as problematic. This issue affects some unknown processing of the component HTTP Handler. The manipulation with an unknown input leads to denial of service. It is possible to l…