Weakness (CWE)
CWE-415: Double Free
The product calls free() twice on the same memory address.
How to prevent it (3 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
-
Implementation
Use a static analysis tool to find double free instances.
Source: MITRE CWE-415
522 results · Feed
-
High 7.8
usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd() When unregister pd capabilitie in tcpm, KASAN will capture below double -free issue. The root cause is the same capabiliti…
-
Medium 4.4
nvme-fc: do not wait in vain when unloading module
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: do not wait in vain when unloading module The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between…
-
High 8.2
Qemu: virtio: dma reentrancy issue leads to double free vulnerability
A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to…
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
-
High 7.5
Libdwarf: crashes randomly on fuzzed object
A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.
-
High 7.0
Windows USB Print Driver Elevation of Privilege Vulnerability
Windows USB Print Driver Elevation of Privilege Vulnerability
-
Critical 9.8
Azure IoT Platform Device SDK Double Free Vulnerability
The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cause a double free problem. This may cause a RCE. Update submodule with commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987.
-
Critical 9.8
A double-free vulnerability exists in the BrainVision Header Parsing functionality of The Biosig Project libbiosig Mast…
-
Critical 9.8
A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosi…
-
High 8.7
A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.0…
-
High 7.5
Junos OS: SRX Series: When "tcp-encap" is configured and specific packets are received flowd will crash
A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). In a remote access VPN scenario, if a "tcp-encap-profile" is conf…
-
Medium 4.7
The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file ne…
-
Medium 6.7
Double Free in Data Network Stack & Connectivity
Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.
-
Medium 5.5
Tcpreplay: tcprewrite: double free in tcpedit_dlt_cleanup() in plugins/dlt_plugins.c
Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnerability can be exploited by supplying a specifically crafted file to the tcprewrite binary. This flaw…
-
High 8.3
A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1…
-
High 7.3
Attempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbis
stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, but some of the pointers in `f->comment_list` are left initiali…
-
High 7.3
Possible double-free or memory leak in stbi__load_gif_main in stb_image
stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesn’t do …
-
High 7.3
Double-free in stbi__load_gif_main_outofmem in stb_image
stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is z…
-
High 8.6
Malformed DATA submessage leads to bad-free error in Fast-DDS
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). In affected versions specific DATA submessages can be sent to a discovery locator which may trigger a free error. This can remotely crash an…
-
High 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
-
High 7.8
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
-
Medium 6.7
In rpmb , there is a possible double free due to improper locking. This could lead to local escalation of privilege wit…
-
High 7.4
OP-TEE double free in shdr_verify_signature
OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, `shdr_verify_signature` can make a double fre…
-
High 7.0
Kernel: btrfs: double free in btrfs_get_root_ref()
A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked inte…
-
High 8.8
kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticate…
-
High 7.8
Microsoft Office Remote Code Execution Vulnerability
Microsoft Office Remote Code Execution Vulnerability
-
Medium 6.7
Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects
A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which m…
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
-
Medium 6.8
Double Free in Modem
Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
-
Medium 6.5
hnswlib Double Free vulnerability
Hnswlib 0.7.0 has a double free in init_index when the M argument is a large integer.
-
High 7.5
A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel. This flaw, dur…
-
High 7.0
Windows Filtering Platform Elevation of Privilege Vulnerability
Windows Filtering Platform Elevation of Privilege Vulnerability
-
High 7.8
Windows Geolocation Service Remote Code Execution Vulnerability
Windows Geolocation Service Remote Code Execution Vulnerability
-
High 7.8CVE-2023-33137 Public exploit
Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
-
High 8.4
Double free in Linux Networking
Memory corruption in Linux Networking due to double free while handling a hyp-assign.
-
High 8.4
Double free in Core
Memory corruption due to double free in Core while mapping HLOS address to the list.
-
High 8.4
Double free in Automotive
Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.
-
Medium 6.7
Double free in Linux-Android
Memory corruption in Linux android due to double free while calling unregister provider after register call.
-
High 7.8
In adreno_set_param of adreno_gpu.c, there is a possible memory corruption due to a double free. This could lead to loc…
-
Medium 6.3
Double free in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable inform…