CWE-672: Operation on a Resource after Expiration or Release

How it's found

Operation on a Resource after Expiration or Release describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.

Vulnerable vs. safe

result = ERROR;free(messageBody);messageBody = (char*)malloc(length*sizeof(char));messageBody = &message[1][0];int success = processMessageBody(messageBody);if (success == ERROR) {}

printf("Unable to process message; invalid message length");result = FAIL;

logError("Error processing message", messageBody);int result = SUCCESS;int length = getMessageLength(message[0]);char *messageBody;if ((length > 0) && (length < MAX_MESSAGE_SIZE)) {}else {}if (result == ERROR) {}return result;#define FAIL 0#define SUCCESS 1#define ERROR -1#define MAX_MESSAGE_SIZE 32int processMessage(char **message){}

result = ERROR;logError("Error processing message", messageBody);free(messageBody);...messageBody = (char*)malloc(length*sizeof(char));messageBody = &message[1][0];int success = processMessageBody(messageBody);if (success == ERROR) {}...

Consequences

• Modify Application Data, Read Application Data: If a released resource is subsequently reused or reallocated, then an attempt to use the original resource might allow access to sensitive data that is associated with a different user or entity.
• Other, DoS: Crash, Exit, or Restart: When a resource is released it might not be in an expected state, later attempts to access the resource may lead to resultant errors that may lead to a crash.

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Class weakness
  CWE-666: Operation on Resource in Wrong Phase of Lifetime