CWE-416:免费后使用
查看自定义信息:
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
使用以前的内存可能会带来任何不利后果,从有效数据的损坏到执行任意代码,具体取决于缺陷的实例化和时机。可能发生数据损坏的最简单方法涉及系统对释放内存的重复使用。无使用后错误有两个常见的原因,有时是重叠的原因:
In this scenario, the memory in question is allocated to another pointer validly at some point after it has been freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process. 例如,如果新分配的数据恰好在C ++中持有类,则可以在堆数据中散布各种函数指针。如果这些函数指针之一被覆盖有效的shellCode地址,则可以实现任意代码的执行。
该表显示了与该弱点相关的弱点和高级类别。这些关系定义为childof,parentof,ementof,并深入了解可能存在于较高和较低抽象水平的类似项目。此外,定义了诸如Peerof和Canalsobe之类的关系,以显示用户可能想要探索的类似弱点。
与观点“研究概念”相关(CWE-1000)
与“简化已发表漏洞的简化映射”(CWE-1003)相关的视图相关(CWE-1003)
与“ CISQ质量措施(2020)”相关(CWE-1305)
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
This listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.
Languages C(不确定的患病率) C ++(不确定的患病率)
This table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
示例1 The following example demonstrates the weakness.
(不良代码)
示例语言:C
#include
#include #define bufsizer1 512 #define bufsizer2((BufSizer1/2)-8) int main(int argc, char **argv) {
char *buf1R1; }char *buf2r1; char *buf2R2; char *buf3r2; buf1R1 = (char *) malloc(BUFSIZER1); buf2r1 =(char *)malloc(bufsizer1); 免费(BUF2R1); buf2R2 = (char *) malloc(BUFSIZER2); buf3R2 = (char *) malloc(BUFSIZER2); strncpy(buf2r1,argv [1],bufsizer1-1); free(buf1R1); 免费(BUF2R2); 免费(BUF3R2); 示例2 The following code illustrates a use after free error:
(不良代码)
示例语言:C
char* ptr = (char*)malloc (SIZE);
if(err){
ABRT = 1; }免费(ptr); 。。。 if (abrt) {
logerror(“在提交之前流产”,ptr); }发生错误时,指针会立即释放。但是,该指针以后在Logerror函数中错误地使用。
此成员关系表显示了其他CWE类别和视图,将此弱点称为成员。该信息通常可用于理解弱点适合外部信息源的何处。
提供更多信息 - 请选择其他过滤器。
|
使用共同弱点枚举(CWE)和本网站的相关参考Terms of Use。CWE由美国国土安全部(DHS)网络安全和基础设施安全局(CISA) and managed by the国土安全系统工程和开发研究所(HSSEDI)由manbetx客户端首页(MITER)。版权所有©2006–2022,Miter Comanbetx客户端首页rporation。CWE,CWSS,CWRAF和CWE徽标是Miter Corporation的商标。manbetx客户端首页 |