Operation on a Resource after Expiration or Release

Opis

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

Skutki

• Integrity, Confidentiality

  Modify Application Data; Read Application Data

  If a released resource is subsequently reused or reallocated, then an attempt to use the original resource might allow access to sensitive data that is associated with a different user or entity.

• Other, Availability

  Other; DoS: Crash, Exit, or Restart

  When a resource is released it might not be in an expected state, later attempts to access the resource may lead to resultant errors that may lead to a crash.

Przykłady podatności

• CVE-2009-3547 Chain: race condition (CWE-362) might allow resource to be released before operating on it, leading to NULL dereference (CWE-476)

Słabość nadrzędna

• CWE-666 Operation on Resource in Wrong Phase of Lifetime

Słabości podrzędne

• CWE-298 Improper Validation of Certificate Expiration
• CWE-324 Use of a Key Past its Expiration Date
• CWE-415 Double Free
• CWE-416 Use After Free
• CWE-613 Insufficient Session Expiration
• CWE-825 Expired Pointer Dereference
• CWE-910 Use of Expired File Descriptor

Kiedy powstaje

• Implementation
• Operation

Dotyczy

Not Language-Specific, Mobile

Źródła

1. Automated Source Code Security Measure (ASCSM) — Object Management Group (OMG), ASCSM-CWE-672, 2016