Improper Control of a Resource Through its Lifetime

Opis

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Resources often have explicit instructions on how to be created, used and destroyed. When code does not follow these instructions, it can lead to unexpected behaviors and potentially exploitable states.

Even without explicit instructions, various principles are expected to be adhered to, such as "Do not use an object until after its creation is complete," or "do not use an object after it has been slated for destruction."

Skutki

• Other

  Other

Przykłady podatności

• CVE-2018-1000613 Cryptography API uses unsafe reflection when deserializing a private key
• CVE-2019-19911 Chain: Python library does not limit the resources used to process images that specify a very large number of bands (CWE-1284), leading to excessive memory consumption (CWE-789) or an integer overflow (CWE-190).

Słabości podrzędne

• CWE-118 Incorrect Access of Indexable Resource ('Range Error')
• CWE-221 Information Loss or Omission
• CWE-372 Incomplete Internal State Distinction
• CWE-400 Uncontrolled Resource Consumption
• CWE-404 Improper Resource Shutdown or Release
• CWE-410 Insufficient Resource Pool
• CWE-471 Modification of Assumed-Immutable Data (MAID)
• CWE-487 Reliance on Package-level Scope
• CWE-495 Private Data Structure Returned From A Public Method
• CWE-496 Public Data Assigned to Private Array-Typed Field
• CWE-501 Trust Boundary Violation
• CWE-580 clone() Method Without super.clone()
• CWE-610 Externally Controlled Reference to a Resource in Another Sphere
• CWE-662 Improper Synchronization
• CWE-665 Improper Initialization
• CWE-666 Operation on Resource in Wrong Phase of Lifetime
• CWE-668 Exposure of Resource to Wrong Sphere
• CWE-669 Incorrect Resource Transfer Between Spheres
• CWE-673 External Influence of Sphere Definition
• CWE-704 Incorrect Type Conversion or Cast
• CWE-706 Use of Incorrectly-Resolved Name or Reference
• CWE-911 Improper Update of Reference Count
• CWE-913 Improper Control of Dynamically-Managed Code Resources
• CWE-922 Insecure Storage of Sensitive Information
• CWE-1229 Creation of Emergent Resource
• CWE-1250 Improper Preservation of Consistency Between Independent Representations of Shared State
• CWE-1329 Reliance on Component That is Not Updateable

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific

Uwagi

More work is needed on this entry and its children. There are perspective/layering issues; for example, one breakdown is based on lifecycle phase (CWE-404, CWE-665), while other children are independent of lifecycle, such as CWE-400. Others do not specify as many bases or variants, such as CWE-704, which primarily covers numbers at this stage.