CWE-672: Operation on a Resource after Expiration or Release

Description

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

Abstraction: ClassAn abstract weakness, independent of any specific language or technology.
Likelihood of exploit: Not rated by MITRE
Status: Draft

Common consequences

IntegrityConfidentiality
Modify Application Data; Read Application Data
If a released resource is subsequently reused or reallocated, then an attempt to use the original resource might allow access to sensitive data that is associated with a different user or entity.
OtherAvailability
Other; DoS: Crash, Exit, or Restart
When a resource is released it might not be in an expected state, later attempts to access the resource may lead to resultant errors that may lead to a crash.

Related weaknesses

Parent weaknesses

CWE-666Operation on Resource in Wrong Phase of Lifetime

Child weaknesses

CAPEC attack patterns that exploit it

CWE 4.20 links no CAPEC attack pattern to this weakness.

Common consequences

IntegrityConfidentiality

Modify Application Data; Read Application Data

If a released resource is subsequently reused or reallocated, then an attempt to use the original resource might allow access to sensitive data that is associated with a different user or entity.

OtherAvailability

Other; DoS: Crash, Exit, or Restart

When a resource is released it might not be in an expected state, later attempts to access the resource may lead to resultant errors that may lead to a crash.