Multiple Operations on Resource in Single-Operation Context

Opis

The product performs the same operation on a resource two or more times, when the operation should only be applied once.

Skutki

• Other

  Other

Przykłady podatności

• CVE-2009-0935 Attacker provides invalid address to a memory-reading function, causing a mutex to be unlocked twice
• CVE-2019-13351 file descriptor double close can cause the wrong file to be associated with a file descriptor.
• CVE-2004-1939 XSS protection mechanism attempts to remove "/" that could be used to close tags, but it can be bypassed using double encoded slashes (%252F)

Słabość nadrzędna

• CWE-573 Improper Following of Specification by Caller

Pokrewna

• CWE-586 Explicit Call to Finalize()
• CWE-102 Struts: Duplicate Validation Forms

Słabości podrzędne

• CWE-174 Double Decoding of the Same Data
• CWE-605 Multiple Binds to the Same Port
• CWE-764 Multiple Locks of a Critical Resource
• CWE-765 Multiple Unlocks of a Critical Resource
• CWE-1341 Multiple Releases of Same Resource or Handle

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific

Uwagi

This weakness is probably closely associated with other issues related to doubling, such as CWE-462 (duplicate key in alist) or CWE-102 (Struts duplicate validation forms). It's usually a case of an API contract violation (CWE-227).