Double Free

Opis

The product calls free() twice on the same memory address.

Inne nazwy

Double-free

Skutki

• Integrity, Confidentiality, Availability

  Modify Memory; Execute Unauthorized Code or Commands

  When a program calls free() twice with the same argument, the program's memory management data structures may become corrupted, potentially leading to the reading or modification of unexpected memory addresses. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.

  Doubly freeing memory may result in a write-what-where condition, allowing an attacker to execute arbitrary code.

Zapobieganie

• Architecture and Design

  Choose a language that provides automatic memory management.

• Implementation

  Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.

• Implementation

  Use a static analysis tool to find double free instances.

Przykłady podatności

• CVE-2006-5051 Chain: Signal handler contains too much functionality (CWE-828), introducing a race condition (CWE-362) that leads to a double free (CWE-415).
• CVE-2004-0642 Double free resultant from certain error conditions.
• CVE-2004-0772 Double free resultant from certain error conditions.
• CVE-2005-1689 Double free resultant from certain error conditions.
• CVE-2003-0545 Double free from invalid ASN.1 encoding.
• CVE-2003-1048 Double free from malformed GIF.
• CVE-2005-0891 Double free from malformed GIF.
• CVE-2002-0059 Double free from malformed compressed data.

Słabość nadrzędna

• CWE-825 Expired Pointer Dereference
• CWE-1341 Multiple Releases of Same Resource or Handle
• CWE-672 Operation on a Resource after Expiration or Release
• CWE-666 Operation on Resource in Wrong Phase of Lifetime

Pokrewna

• CWE-416 Use After Free
• CWE-123 Write-what-where Condition

Kiedy powstaje

• Implementation

Dotyczy

Memory-Unsafe, C, C++

Uwagi

This is usually resultant from another weakness, such as an unhandled error or race condition between threads. It could also be primary to weaknesses such as buffer overflows.

It could be argued that Double Free would be most appropriately located as a child of "Use after Free", but "Use" and "Release" are considered to be distinct operations within vulnerability theory, therefore this is more accurately "Release of a Resource after Expiration or Release", which doesn't exist yet.

Źródła

1. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 8: C++ Catastrophes." Page 143, McGraw-Hill, 2010
2. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 7, "Double Frees", Page 379, Addison Wesley, 2006
3. The CLASP Application Security Process — Secure Software, Inc., 2005
4. AddressSanitizer