CWE-404: Improper Resource Shutdown or Release

Description

The product does not release or incorrectly releases a resource before it is made available for re-use.

When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.

Potential Impact

Demonstrative Examples

private void processFile(string fName){BufferReader fil = new BufferReader(new FileReader(fName));String line;while ((line = fil.ReadLine()) != null){processLine(line);}}

private void processFile(string fName){BufferReader fil = new BufferReader(new FileReader(fName));String line;while ((line = fil.ReadLine()) != null){processLine(line);}fil.Close();}

try {Connection con = DriverManager.getConnection(some_connection_string);}catch ( Exception e ) {log( e );}

...SqlConnection conn = new SqlConnection(connString);SqlCommand cmd = new SqlCommand(queryString);cmd.Connection = conn;conn.Open();SqlDataReader rdr = cmd.ExecuteReader();HarvestResults(rdr);conn.Connection.Close();...

int decodeFile(char* fName) {
                        char buf[BUF_SZ];FILE* f = fopen(fName, "r");if (!f) {printf("cannot open %s\n", fName);return DECODE_FAIL;}else {
                              while (fgets(buf, BUF_SZ, f)) {if (!checkChecksum(buf)) {return DECODE_FAIL;}else {decodeBlock(buf);}}
                           }fclose(f);return DECODE_SUCCESS;
                     }

Mitigations & Prevention

Detection Methods

• Automated Dynamic Analysis Moderate — This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash
• Manual Dynamic Analysis — Identify error conditions that are not likely to occur during normal usage and trigger them. For example, run the product under low memory conditions, run with insufficient privileges or permissions, interrupt a transaction before it is completed, or disable connectivity to basic network services su
• Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

Related Weaknesses

Taxonomy Mappings

• PLOVER: — Improper resource shutdown or release
• 7 Pernicious Kingdoms: — Unreleased Resource
• OWASP Top Ten 2004: A9 — Denial of Service
• CERT C Secure Coding: FIO42-C — Close files when they are no longer needed
• CERT C Secure Coding: MEM31-C — Free dynamically allocated memory when no longer needed
• The CERT Oracle Secure Coding Standard for Java (2011): FIO04-J — Release resources when they are no longer needed
• Software Fault Patterns: SFP14 — Failure to release resource