CWE-664: Improper Control of a Resource Through its Lifetime
Description
The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
Resources often have explicit instructions on how to be created, used and destroyed. When code does not follow these instructions, it can lead to unexpected behaviors and potentially exploitable states. Even without explicit instructions, various principles are expected to be adhered to, such as Do not use an object until after its creation is complete, or do not use an object after it has been slated for destruction.
- Abstraction
- PillarThe most abstract kind of weakness: a theme that groups classes.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Other
Other
Related weaknesses
Child weaknesses
- CWE-118Incorrect Access of Indexable Resource ('Range Error')
- CWE-221Information Loss or Omission
- CWE-372Incomplete Internal State Distinction
- CWE-400Uncontrolled Resource Consumption
- CWE-404Improper Resource Shutdown or Release
- CWE-410Insufficient Resource Pool
- CWE-471Modification of Assumed-Immutable Data (MAID)
- CWE-487Reliance on Package-level Scope
- CWE-495Private Data Structure Returned From A Public Method
- CWE-496Public Data Assigned to Private Array-Typed Field
- CWE-501Trust Boundary Violation
- CWE-580clone() Method Without super.clone()
- CWE-610Externally Controlled Reference to a Resource in Another Sphere
- CWE-662Improper Synchronization
- CWE-665Improper Initialization
- CWE-666Operation on Resource in Wrong Phase of Lifetime
- CWE-668Exposure of Resource to Wrong Sphere
- CWE-669Incorrect Resource Transfer Between Spheres
- CWE-673External Influence of Sphere Definition
- CWE-704Incorrect Type Conversion or Cast
- CWE-706Use of Incorrectly-Resolved Name or Reference
- CWE-911Improper Update of Reference Count
- CWE-913Improper Control of Dynamically-Managed Code Resources
- CWE-922Insecure Storage of Sensitive Information
- CWE-1229Creation of Emergent Resource
- CWE-1250Improper Preservation of Consistency Between Independent Representations of Shared State
- CWE-1329Reliance on Component That is Not Updateable