CWE-763: Release of Invalid Pointer or Reference

How it's found

Release of Invalid Pointer or Reference is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.

This weakness can take several forms, such as:The memory was allocated, explicitly or implicitly, via one memory management method and deallocated using a different, non-compatible function (CWE-762). The function calls or memory management routines chosen are appropriate, however they are used incorrectly, such as in CWE-761.

Vulnerable vs. safe

/* do some work with ptr here */BarObj *ptr = new BarObj()...free(ptr);void foo(){}

/* do some work with ptr here */BarObj *ptr = new BarObj()...delete ptr;void foo(){}

Consequences

• Modify Memory, DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands: This weakness may result in the corruption of memory, and perhaps instructions, possibly leading to a crash. If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code.

Mitigations

• Implementation: Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().
• Implementation: When programming in C++, consider using smart pointers provided by the boost library to help correctly and consistently manage memory.
• Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, glibc in Linux provides protection against free of invalid pointers.
• Architecture and Design: Use a language that provides abstractions for memory allocation and deallocation.

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Class weakness
  CWE-404: Improper Resource Shutdown or Release