Sensitive Information in Resource Not Removed Before Reuse

Opis

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

When resources are released, they can be made available for reuse. For example, after memory is de-allocated, an operating system may make the memory available to another process, or disk space may be reallocated when a file is deleted. As removing information requires time and additional resources, operating systems do not usually clear the previously written information.

Even when the resource is reused by the same process, this weakness can arise when new data is not as large as the old data, which leaves portions of the old data still available. Equivalent errors can occur in other situations where the length of data is variable but the associated data structure is not. If memory is not cleared after use, the information may be read by less trustworthy parties when the memory is reallocated.

This weakness can apply in hardware, such as when a device or system switches between power, sleep, or debug states during normal operation, or when execution changes to different users or privilege levels.

Skutki

• Confidentiality

  Read Application Data

Zapobieganie

• Architecture and Design, Implementation

  During critical state transitions, information not needed in the next state should be removed or overwritten with fixed patterns (such as all 0's) or random data, before the transition to the next state.

  Skuteczność: High

• Architecture and Design, Implementation

  When releasing, de-allocating, or deleting a resource, overwrite its data and relevant metadata with fixed patterns or random data. Be cautious about complex resource types whose underlying representation might be non-contiguous or change at a low level, such as how a file might be split into different chunks on a file system, even though "logical" file positions are contiguous at the application layer. Such resource types might require invocation of special modes or APIs to tell the underlying operating system to perform the necessary clearing, such as SDelete (Secure Delete) on Windows, although the appropriate functionality might not be available at the application layer.

  Skuteczność: High

Przykłady podatności

• CVE-2019-3733 Cryptography library does not clear heap memory before release
• CVE-2003-0001 Ethernet NIC drivers do not pad frames with null bytes, leading to infoleak from malformed packets.
• CVE-2003-0291 router does not clear information from DHCP packets that have been previously used
• CVE-2005-1406 Products do not fully clear memory buffers when less data is stored into the buffer than previous.
• CVE-2005-1858 Products do not fully clear memory buffers when less data is stored into the buffer than previous.
• CVE-2005-3180 Products do not fully clear memory buffers when less data is stored into the buffer than previous.
• CVE-2005-3276 Product does not clear a data structure before writing to part of it, yielding information leak of previously used memory.
• CVE-2002-2077 Memory not properly cleared before reuse.

Słabość nadrzędna

• CWE-459 Incomplete Cleanup
• CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer

Może prowadzić do

• CWE-201 Insertion of Sensitive Information Into Sent Data

Słabości podrzędne

• CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection')
• CWE-1239 Improper Zeroization of Hardware Register
• CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition
• CWE-1301 Insufficient or Incomplete Data Removal within Hardware Component
• CWE-1342 Information Exposure through Microarchitectural State after Transient Execution

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific

Uwagi

There is a close association between CWE-226 and CWE-212. The difference is partially that of perspective. CWE-226 is geared towards the final stage of the resource lifecycle, in which the resource is deleted, eliminated, expired, or otherwise released for reuse. Technically, this involves a transfer to a different control sphere, in which the original contents of the resource are no longer relevant. CWE-212, however, is intended for sensitive data in resources that are intentionally shared with others, so they are still active. This distinction is useful from the perspective of the CWE research view (CWE-1000).

This entry needs modification to clarify the differences with CWE-212. The description also combines two problems that are distinct from the CWE research perspective: the inadvertent transfer of information to another sphere, and improper initialization/shutdown. Some of the associated taxonomy mappings reflect these different uses.

This is frequently found for network packets, but it can also exist in local memory allocation, files, etc.

Źródła

1. aes0_wrapper.sv — 2021
2. Fix for aes0_wrapper — 2023