COMMON WEAKNESS ENUMERATIONDraft

CWE-664

Improper Control of a Resource Through its Lifetime

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Abstraction

Pillar

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Extended description

Resources often have explicit instructions on how to be created, used and destroyed. When code does not follow these instructions, it can lead to unexpected behaviors and potentially exploitable states. Even without explicit instructions, various principles are expected to be adhered to, such as "Do not use an object until after its creation is complete," or "do not use an object after it has been slated for destruction."

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

Risk

What does successful exploitation lead to?

Other

Affected security scopes: Other

Defence

How is it prevented and fixed?

  • Follow secure coding guidelines for input handling and boundary checking.
  • Enforce strict security reviews and automated static analysis (SAST) checks.

Verification

How is it detected?

Automated Static Analysis

Use Static analysis tools to check for unreleased resources.