Description

The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

Extended Description

Limited resources include memory, file system storage, database connection pool entries, or CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the software, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.

Resource exhaustion problems have at least two common causes:

Error conditions and other exceptional circumstances

Confusion over which part of the program is responsible for releasing the resource

Likelihood of Exploit: Medium to High

Applicable Platforms
Language Class: All

Time Of Introduction

• Operation
• Architecture and Design
• Implementation

Related Attack Patterns

• CAPEC-147
• CAPEC-197
• CAPEC-2
• CAPEC-228
• CAPEC-82

Common Consequences

Detection Methods

Potential Mitigations

Relationships

Demonstrative Examples   (Details)

1. In the following example a server socket connection is used to accept a request to store data on the local file system using a specified filename. The method openSocketConnection establishes a server socket to accept requests from a client. When a client establishes a connection to this service the getNextMessage method is first used to retrieve from the socket the name of the file to store the data, the openFileToWrite method will validate the filename and open a file to write to on the local file system. The getNextMessage is then used within a while loop to continuously read data from the socket and output the data to the file until there is no longer any data from the socket. (Demonstrative Example Id DX-50)
2. In the following example, a server object creates a server socket and accepts client connections to the socket. For every client connection to the socket a separate thread object is generated using the ClientSocketThread class that handles request made by the client through the socket. (Demonstrative Example Id DX-52)
3. In the following example, the processMessage method receives a two dimensional character array containing the message to be processed. The two-dimensional character array contains the length of the message in the first character array and the message body in the second character array. The getMessageLength method retrieves the integer value of the length from the first character array. After validating that the message length is greater than zero, the body character array pointer points to the start of the second character array of the two-dimensional character array and memory is allocated for the new body character array. (Demonstrative Example Id DX-51)
4. This code allocates a socket and forks each time it receives a new connection. (Demonstrative Example Id DX-25)

Observed Examples

1. CVE-2009-2874 : Product allows attackers to cause a crash via a large number of connections.
2. CVE-2009-1928 : Malformed request triggers uncontrolled recursion, leading to stack exhaustion.
3. CVE-2009-2858 : Chain: memory leak (CWE-404) leads to resource exhaustion.
4. CVE-2009-2726 : Driver does not use a maximum width when invoking sscanf style functions, causing stack consumption.
5. CVE-2009-2540 : Large integer value for a length property in an object causes a large amount of memory allocation.
6. CVE-2009-2299 : Web application firewall consumes excessive memory when an HTTP request contains a large Content-Length value but no POST data.
7. CVE-2009-2054 : Product allows exhaustion of file descriptors when processing a large number of TCP packets.
8. CVE-2008-5180 : Communication product allows memory consumption with a large number of SIP requests, which cause many sessions to be created.
9. CVE-2008-2121 : TCP implementation allows attackers to consume CPU and prevent new connections using a TCP SYN flood attack.
10. CVE-2008-2122 : Port scan triggers CPU consumption with processes that attempt to read data from closed sockets.
11. CVE-2008-1700 : Product allows attackers to cause a denial of service via a large number of directives, each of which opens a separate window.
12. CVE-2007-4103 : Product allows resource exhaustion via a large number of calls that do not complete a 3-way handshake.
13. CVE-2006-1173 : Mail server does not properly handle deeply nested multipart MIME messages, leading to stack exhaustion.
14. CVE-2007-0897 : Chain: anti-virus product encounters a malformed file but returns from a function without closing a file descriptor (CWE-775) leading to file descriptor consumption (CWE-400) and failed scans.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

References:

1. Joao Antunes Nuno Ferreira Neves Paulo Verissimo .Detection and Prediction of Resource-Exhaustion Vulnerabilities. Proceedings of the IEEE International Symposium on Software Reliability Engineering (ISSRE). Published on November 2008.
2. D.J. Bernstein .Resource exhaustion.
3. Pascal Meunier .Resource exhaustion. Secure Programming Educational Material. Published on 2004.
4. M. Howard D. LeBlanc .Writing Secure Code 2nd Edition. Microsoft. Section:'Chapter 17, "Protecting Against Denial of Service Attacks" Page 517'. Published on 2002.