Description

The software does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Extended Description

When a resource is not released after use, it can allow attackers to cause a denial of service.

Likelihood of Exploit: Medium to High

Applicable Platforms
None

Time Of Introduction

• Architecture and Design
• Implementation

Related Attack Patterns

• CAPEC-469

Common Consequences

Detection Methods
None

Potential Mitigations

Relationships

Demonstrative Examples   (Details)

1. If an exception occurs after establishing the database connection and before the same connection closes, the pool of database connections may become exhausted. If the number of available connections is exceeded, other users cannot access this resource, effectively denying access to the application. Using the following database connection pattern will ensure that all opened connections are closed. The con.close() call should be the first executable statement in the finally block. (Demonstrative Example Id DX-82)
2. In this example, the program calls the delete[] function on non-heap memory. (Demonstrative Example Id DX-86)
3. In this example, the program does not use matching functions such as malloc/free, new/delete, and new[]/delete[] to allocate/deallocate the resource. (Demonstrative Example Id DX-85)
4. The following C function does not close the file handle it opens if an error occurs. If the process is long-lived, the process can run out of file handles. (Demonstrative Example Id DX-84)
5. The following code attempts to open a new connection to a database, process the results returned by the database, and close the allocated SqlConnection object.
6. The following code attempts to process a file by reading it in line by line until the end has been reached.
7. The following method never closes the file handle it opens. The Finalize() method for StreamReader eventually calls Close(), but there is no guarantee as to how long it will take before the Finalize() method is invoked. In fact, there is no guarantee that Finalize() will ever be invoked. In a busy environment, this can result in the VM using up all of its available file handles. (Demonstrative Example Id DX-81)
8. Under normal conditions the following C# code executes a database query, processes the results returned by the database, and closes the allocated SqlConnection object. But if an exception occurs while executing the SQL or processing the results, the SqlConnection object is not closed. If this happens often enough, the database will run out of available cursors and not be able to execute any more SQL queries. (Demonstrative Example Id DX-83)

Observed Examples

1. CVE-2007-0897 : Chain: anti-virus product encounters a malformed file but returns from a function without closing a file descriptor (CWE-775) leading to file descriptor consumption (CWE-400) and failed scans.
2. CVE-2001-0830 : Sockets not properly closed when attacker repeatedly connects and disconnects from server.
3. CVE-1999-1127 : Does not shut down named pipe connections if malformed data is sent.
4. CVE-2009-2858 : Chain: memory leak (CWE-404) leads to resource exhaustion.
5. CVE-2009-2054 : Product allows exhaustion of file descriptors when processing a large number of TCP packets.
6. CVE-2008-2122 : Port scan triggers CPU consumption with processes that attempt to read data from closed sockets.
7. CVE-2007-4103 : Product allows resource exhaustion via a large number of calls that do not complete a 3-way handshake.
8. CVE-2002-1372 : Return values of file/socket operations not checked, allowing resultant consumption of file descriptors.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

References:
None