CWE-672: Operation on a Resource after Expiration or Release
| Abstraction | Structure | Status |
|---|---|---|
| None | Simple | Draft |
Description
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Related Weaknesses
| Nature | ID | View ID | Name |
|---|---|---|---|
| ChildOf | CWE-666 | 1000 | Operation on Resource in Wrong Phase of Lifetime |
Modes of Introduction
| Phase | Note |
|---|---|
| Implementation | - |
| Operation | - |
Applicable Platforms
Languages
Class: Not Language-Specific
Technologies
Class: Mobile
Common Consequences
| Scope | Impact | Note |
|---|---|---|
| Integrity, Confidentiality | Modify Application Data, Read Application Data | If a released resource is subsequently reused or reallocated, then an attempt to use the original resource might allow access to sensitive data that is associated with a different user or entity. |
| Other, Availability | Other, DoS: Crash, Exit, or Restart | When a resource is released it might not be in an expected state, later attempts to access the resource may lead to resultant errors that may lead to a crash. |
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect “sources” (origins of input) with “sinks” (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Observed Examples
- CVE-2009-3547: Chain: race condition (CWE-362) might allow resource to be released before operating on it, leading to NULL dereference (CWE-476)