Description

The software uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

Applicable Platforms
None

Time Of Introduction

• Architecture and Design
• Implementation
• Operation

Common Consequences

Detection Methods
None

Potential Mitigations
None

Relationships

Demonstrative Examples   (Details)

1. In the following C/C++ example the method processMessage is used to process a message received in the input array of char arrays. The input message array contains two char arrays: the first is the length of the message and the second is the body of the message. The length of the message is retrieved and used to allocate enough memory for a local char array, messageBody, to be created for the message body. The messageBody is processed in the method processMessageBody that will return an error if an error occurs while processing. If an error occurs then the return result variable is set to indicate an error and the messageBody char array memory is released using the method free and an error message is sent to the logError method.
2. The following code shows a simple example of a double free error: (Demonstrative Example Id DX-72)
3. The following code shows a simple example of a use after free error: (Demonstrative Example Id DX-71)

Observed Examples

1. CVE-2009-3547 : chain: race condition might allow resource to be released before operating on it, leading to NULL dereference

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings
None

References:
None