CWE-415: Double Free

Description

The product calls free() twice on the same memory address.

Potential Impact

Demonstrative Examples

char* ptr = (char*)malloc (SIZE);
				   ...
				   if (abrt) {
				   
					 free(ptr);
				   
				   }
				   ...
				   free(ptr);

#include <stdio.h>#include <unistd.h>#define BUFSIZE1 512#define BUFSIZE2 ((BUFSIZE1/2) - 8)
                     int main(int argc, char **argv) {char *buf1R1;char *buf2R1;char *buf1R2;buf1R1 = (char *) malloc(BUFSIZE2);buf2R1 = (char *) malloc(BUFSIZE2);free(buf1R1);free(buf2R1);buf1R2 = (char *) malloc(BUFSIZE1);strncpy(buf1R2, argv[1], BUFSIZE1-1);free(buf2R1);free(buf1R2);}

Mitigations & Prevention

Detection Methods

• Fuzzing High — Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption,
• Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea
• Automated Dynamic Analysis Moderate — Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].

Real-World CVE Examples

Related Weaknesses

Taxonomy Mappings

• PLOVER: — DFREE - Double-Free Vulnerability
• 7 Pernicious Kingdoms: — Double Free
• CLASP: — Doubly freeing memory
• CERT C Secure Coding: MEM00-C — Allocate and free memory in the same module, at the same level of abstraction
• CERT C Secure Coding: MEM01-C — Store a new value in pointers immediately after free()
• CERT C Secure Coding: MEM30-C — Do not access freed memory
• CERT C Secure Coding: MEM31-C — Free dynamically allocated memory exactly once
• Software Fault Patterns: SFP12 — Faulty Memory Release