CWE-826: Premature Release of Resource During Expected Lifetime

In more detail

This weakness focuses on errors in which the product should not release a resource, but performs the release anyway. This is different than a weakness in which the product releases a resource at the appropriate time, but it maintains a reference to the resource, which it later accesses. For this weakness, the resource should still be valid upon the subsequent access. When a product releases a resource that is still being used, it is possible that operations will still be taken on this resource, which may have been repurposed in the meantime, leading to issues similar to CWE-825. Consequences may include denial of service, information exposure, or code execution.

What an attacker can do

• Read Application Data (Confidentiality)
• Read Memory (Confidentiality)
• DoS: Crash, Exit, or Restart (Availability)
• Execute Unauthorized Code or Commands (Integrity, Confidentiality, Availability)
• Modify Application Data (Integrity, Confidentiality, Availability)
• Modify Memory (Integrity, Confidentiality, Availability)

How to prevent it

MITRE lists no specific mitigation for this weakness. Treat it like its parent weaknesses below: validate input, keep the design simple and review the code where it could appear.

How to find it

• Automated Static Analysis. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

CWE-826 on MITRE's CWE site