CWE-415: Double Free
Description
The product calls free() twice on the same memory address.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- High
- Status
- Draft
Common consequences
- IntegrityConfidentialityAvailability
Modify Memory; Execute Unauthorized Code or Commands
When a program calls free() twice with the same argument, the program's memory management data structures may become corrupted, potentially leading to the reading or modification of unexpected memory addresses. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc()...
Potential mitigations
- Architecture and Design
Choose a language that provides automatic memory management.
- Implementation
Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Implementation
Use a static analysis tool to find double free instances.
Related weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.