Weakness (CWE)
CWE-415: Double Free
The product calls free() twice on the same memory address.
How to prevent it (3 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
-
Implementation
Use a static analysis tool to find double free instances.
Source: MITRE CWE-415
522 results · Feed
-
High 8.4
9p/xen: fix release of IRQ
In the Linux kernel, the following vulnerability has been resolved: 9p/xen: fix release of IRQ Kernel logs indicate an IRQ was double-freed. Pass correct device ID during IRQ release. [Dominique: remove confusing variable reset to 0]
-
High 7.8
net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation In lan78xx_probe(), the buffer `buf` was being freed twice: once implicitly through `usb_free_urb(dev->urb_intr)` wit…
-
High 7.8
wifi: ath12k: fix warning when unbinding
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released. However this is released again…
-
High 7.0
Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability
Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability
-
High 7.8
drm/amd/display: Handle dml allocation failure to avoid crash
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Handle dml allocation failure to avoid crash [Why] In the case where a dml allocation fails for any reason, the current state's dml contexts would no longer be valid. Then su…
-
High 7.5
Double Free in µD3TN
Double-Free Vulnerability in uD3TN BPv7 Caused by Malformed Endpoint Identifier allows remote attacker to reliably cause DoS
-
Critical 9.8
FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.
-
Critical 9.8
A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under speci…
-
Critical 9.8
net: vertexcom: mse102x: Fix possible double free of TX skb
In the Linux kernel, the following vulnerability has been resolved: net: vertexcom: mse102x: Fix possible double free of TX skb The scope of the TX skb is wider than just mse102x_tx_frame_spi(), so in case the TX skb room needs to be expanded, we should free …
-
Critical 9.8
OpenBSD NFS double-free vulnerability
In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.
-
High 7.8
Substance3D - Painter | Double Free (CWE-415)
Substance3D - Painter versions 10.1.0 and earlier are affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a m…
-
High 8.8
SQL Server Native Client Remote Code Execution Vulnerability
SQL Server Native Client Remote Code Execution Vulnerability
-
High 7.8
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
-
High 8.1
Windows SMBv3 Server Remote Code Execution Vulnerability
Windows SMBv3 Server Remote Code Execution Vulnerability
-
High 7.8
wifi: cfg80211: clear wdev->cqm_config pointer on free
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: clear wdev->cqm_config pointer on free When we free wdev->cqm_config when unregistering, we also need to clear out the pointer since the same wdev/netdev may get re-registered…
-
High 8.1
nvmet-auth: assign dh_key to NULL after kfree_sensitive
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: assign dh_key to NULL after kfree_sensitive ctrl->dh_key might be used across multiple calls to nvmet_setup_dhgroup() for the same controller. So it's better to nullify it after r…
-
High 8.4
Liteos_a has a double free vulnerability
in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through double free.
-
Medium 6.0
Eclipse Mosquito: Double free vulnerability
In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection …
-
High 7.8
pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func() 'new_map' is allocated using devm_* which takes care of freeing the allocated data on device removal, call to .dt_fre…
-
High 7.4
In lwis_device_event_states_clear_locked of lwis_event.c, there is a possible privilege escalation due to a double free…
-
Medium 5.9
This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6…
-
High 8.6
Picotls double free
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, picotls (specifically, bindings within picotls that call the crypto libraries) may attempt to free the …
-
High 7.8
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
-
Medium 6.7
Double Free in DSP Services
Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.
-
High 8.6
Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gat…
-
High 7.8
Windows Graphics Component Elevation of Privilege Vulnerability
Windows Graphics Component Elevation of Privilege Vulnerability
-
Medium 4.4
Double-free in libpcap before 1.10.5 with remote packet capture support.
In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be …
-
High 7.0
Azure IoT SDK Remote Code Execution Vulnerability
Azure IoT SDK Remote Code Execution Vulnerability
-
Medium 4.5
Vim double free in src/alloc.c:616
Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be …
-
High 8.8
Windows MultiPoint Services Remote Code Execution Vulnerability
Windows MultiPoint Services Remote Code Execution Vulnerability
-
High 8.8
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
-
High 8.4
Double Free in HLOS
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
-
High 7.8
Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
A maliciously crafted MODEL file, when parsed in libodxdll through Autodesk applications, can cause a double free. This vulnerability, along with other vulnerabilities, can lead to code execution in the current process.
-
High 8.8
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
-
High 7.2
QTS, QuTS hero
A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute arbitrary code via a network. We have already fixed the vulnerability in the following v…
-
High 7.8
NTFS Elevation of Privilege Vulnerability
NTFS Elevation of Privilege Vulnerability
-
Medium 6.5
A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacke…
-
Medium 4.7
Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availabi…
-
Medium 4.7
Double-free vulnerability in the RSMC module Impact: Successful exploitation of this vulnerability will affect availabi…
-
High 7.5
Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability
Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged…