MetaSeverity: MediumCAPEC-131

CAPEC-131: Resource Leak Exposure

Description

An adversary utilizes a resource leak on the target to deplete the quantity of the resource available to service legitimate requests.

Likelihood of attack: Medium
Typical severity: Medium
Abstraction: MetaA decidedly abstract characterisation of a methodology or technique.

Mechanism of attack: Abuse Existing Functionality

Prerequisites

The target must have a resource leak that the adversary can repeatedly trigger.

Consequences

Availability
Unreliable Execution; Resource Consumption
A successful resource leak exposure attack compromises the availability of the target system's services.

Mitigations

If possible, leverage coding language(s) that do not allow this weakness to occur (e.g., Java, Ruby, and Python all perform automatic garbage collection that releases memory for objects that have been deallocated).
Memory should always be allocated/freed using matching functions (e.g., malloc/free, new/delete, etc.)
Implement best practices with respect to memory management, including the freeing of all allocated resources at all exit points and ensuring consistency with how and where memory is freed in a function.

Related weaknesses (CWE)

CWE-404Improper Resource Shutdown or Release

ATT&CK techniques (CAPEC taxonomy mapping)

T1499Endpoint Denial of Service

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

Mitigations

If possible, leverage coding language(s) that do not allow this weakness to occur (e.g., Java, Ruby, and Python all perform automatic garbage collection that releases memory for objects that have been deallocated).

Memory should always be allocated/freed using matching functions (e.g., malloc/free, new/delete, etc.)

Implement best practices with respect to memory management, including the freeing of all allocated resources at all exit points and ensuring consistency with how and where memory is freed in a function.