Weakness (CWE)
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a language that provides automatic memory management.
-
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE-416
6,520 results · Feed
-
High 8.4
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local es…
-
High 8.4
In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalati…
-
High 8.4
In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to…
-
Critical 9.8
In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote c…
-
Critical 9.8
In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code …
-
High 8.1
In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote …
-
High 8.4
In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to lo…
-
High 8.4
In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local e…
-
High 8.4
In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to loca…
-
High 8.4
In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local esca…
-
High 8.4
In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead t…
-
High 8.4
In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote escal…
-
High 8.4
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation…
-
Medium 5.9
UAF vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect avai…
-
High 7.3
VStarcam O-KAM SuperIPCam P2P Session Teardown SuperIPCam.exe FUN_005a2d44 use after free
A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated re…
-
High 8.4
In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local es…
-
Medium 4.4
In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicio…
-
Medium 6.7
In usb, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege i…
-
Medium 4.4
In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicio…
-
Medium 6.7
In adsp, there is a possible escalation of privilege due to use after free. This could lead to local escalation of priv…
-
Medium 6.7
In adsp, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege …
-
Medium 6.7
In afe, there is a possible system crash due to use after free. This could lead to local escalation of privilege if a m…
-
High 7.8
In GPU pdma, there is a possible memory corruption due to use after free. This could lead to local escalation of privil…
-
High 8.4
In GPU pdma, there is a possible escalation of privilege due to use after free. This could lead to local escalation of …
-
Medium 6.9
Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an…
-
High 8.8
Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()
Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next Finaliza…
-
High 7.8
Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c
A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro …
-
Medium 5.5
SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or wi…
-
Medium 5.5
SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operato…
-
High 7.1
GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM
Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thr…
-
High 7.0
GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lea…
-
High 8.8
Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitra…
-
High 8.8
Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code i…
-
High 8.8
Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code insid…
-
Critical 9.6
Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitr…
-
High 8.8
Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code in…
-
Medium 6.5
Use after free in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary co…
-
High 8.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.