Exécuter une analyse statique (SAST) sur le code source à la recherche du motif non sécurisé dans le flux de données.
CWE-672 Classe Brouillon
Operation on a Resource after Expiration or Release
This vulnerability occurs when a program continues to use a resource—like memory, a file handle, or a network connection—after it has been freed, closed, or is no longer valid.
Définition
What is CWE-672?
This vulnerability occurs when a program continues to use a resource—like memory, a file handle, or a network connection—after it has been freed, closed, or is no longer valid.
Think of this as using a hotel key card after you've checked out. The system has marked that resource as available for reuse, but your code still holds a reference to it. When you try to read, write, or execute operations using this 'stale' reference, the results are unpredictable. The program might crash, leak sensitive data from the now-reallocated memory, or allow an attacker to hijack the resource for their own purposes.
To prevent this, developers must carefully manage the lifecycle of all resources. This means ensuring that every 'malloc' has a matching 'free', every 'open' has a 'close', and that pointers or handles are set to NULL or another invalid state immediately after release. Using modern language features like smart pointers in C++ or try-with-resources in Java can automate this cleanup and make these dangerous 'use-after-free' and 'use-after-close' errors much less likely.
Impact réel
Real-world CVEs caused by CWE-672
-
Chain: race condition (CWE-362) might allow resource to be released before operating on it, leading to NULL dereference (CWE-476)
Comment les attaquants l'exploitent
Parcours de l'attaquant étape par étape
- 1
The following code shows a simple example of a use after free error:
- 2
When an error occurs, the pointer is immediately freed. However, this pointer is later incorrectly used in the logError function.
- 3
The following code shows a simple example of a double free error:
- 4
Double free vulnerabilities have two common (and sometimes overlapping) causes:
- 5
- Error conditions and other exceptional circumstances - Confusion over which part of the program is responsible for freeing the memory
Exemple de code vulnérable
Vulnerable C
The following code shows a simple example of a use after free error:
char* ptr = (char*)malloc (SIZE);
if (err) {
abrt = 1;
free(ptr);
}
...
if (abrt) {
logError("operation aborted before commit", ptr);
} Exemple de code sécurisé
Secure C
However, the call to the method logError includes the messageBody after the memory for messageBody has been released using the free method. This can cause unexpected results and may lead to system crashes. A variable should never be used after its memory resources have been released.
...
messageBody = (char*)malloc(length*sizeof(char));
messageBody = &message[1][0];
int success = processMessageBody(messageBody);
if (success == ERROR) {
result = ERROR;
logError("Error processing message", messageBody);
free(messageBody);
}
... What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Liste de contrôle de prévention
How to prevent CWE-672
- Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
- Implementation Validate input at trust boundaries; use allowlists, not denylists.
- Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
- Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
- Operation Monitor logs for the runtime signals listed in the next section.
Signaux de détection
How to detect CWE-672
Exécuter des tests de sécurité applicative dynamique (DAST) contre le point de terminaison en ligne.
Surveiller les journaux runtime pour détecter des traces d'exception inhabituelles, des entrées malformées ou des tentatives de contournement d'autorisation.
Revue de code : signaler tout nouveau code qui traite les entrées de cette surface sans utiliser les helpers du framework validés.
Plexicus détecte automatiquement CWE-672 et ouvre une PR de correction en moins de 60 secondes.
Codex Remedium analyse chaque commit, identifie cette faiblesse précise et livre une pull request prête à être relue avec le correctif. Pas de tickets. Pas de transferts.
Questions fréquentes Qu'est-ce que CWE-672 ?
Quelle est la gravité de CWE-672 ?
Quels langages ou plateformes sont affectés par CWE-672 ?
Comment puis-je prévenir CWE-672 ?
Comment Plexicus détecte et corrige CWE-672 ?
Où puis-je en savoir plus sur CWE-672 ?
Frequently asked questions
Qu'est-ce que CWE-672 ?
This vulnerability occurs when a program continues to use a resource—like memory, a file handle, or a network connection—after it has been freed, closed, or is no longer valid.
Quelle est la gravité de CWE-672 ?
MITRE n'a pas publié de note de probabilité d'exploitation pour cette faiblesse. Traitez-la comme un impact moyen jusqu'à ce que votre modèle de menace prouve le contraire.
Quels langages ou plateformes sont affectés par CWE-672 ?
MITRE lists the following affected platforms: Mobile.
Comment puis-je prévenir CWE-672 ?
Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.
Comment Plexicus détecte et corrige CWE-672 ?
Le moteur SAST de Plexicus reconnaît la signature de flux de données de CWE-672 à chaque commit. Lorsqu'une correspondance est trouvée, notre agent Codex Remedium ouvre une PR de correction avec le code corrigé, les tests et un résumé d'une ligne pour le relecteur.
Où puis-je en savoir plus sur CWE-672 ?
MITRE publie la définition canonique à https://cwe.mitre.org/data/definitions/672.html. Vous pouvez également consulter la documentation OWASP et NIST pour des conseils adjacents.
Faiblesses associées
Weaknesses related to CWE-672
CWE-666 Parent
Operation on Resource in Wrong Phase of Lifetime
This vulnerability occurs when software interacts with a resource—like memory, a file, or a network connection—at an incorrect stage of…
CWE-415 Frère
Double Free
A double free vulnerability occurs when a program mistakenly calls the 'free()' function twice on the same block of memory.
CWE-593 Frère
Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
This vulnerability occurs when an application modifies an OpenSSL context object after it has already been used to create active SSL/TLS…
CWE-605 Frère
Multiple Binds to the Same Port
This vulnerability occurs when a system's socket configuration allows multiple applications to bind to the same network port…
CWE-826 Frère
Premature Release of Resource During Expected Lifetime
This happens when software incorrectly frees or closes a resource—like memory, a file handle, or a network connection—while that resource…
CWE-298 Enfant
Improper Validation of Certificate Expiration
This vulnerability occurs when an application fails to properly check if a digital certificate has expired, potentially trusting…
CWE-324 Enfant
Use of a Key Past its Expiration Date
This vulnerability occurs when an application continues to use a cryptographic key or password after its designated expiration date. Doing…
CWE-416 Enfant
Use After Free
Use After Free happens when a program continues to use a pointer to a memory location after that memory has been freed. This can lead to…
CWE-613 Enfant
Insufficient Session Expiration
Insufficient session expiration occurs when an application allows old session tokens or IDs to remain valid for too long, letting…
Prêt quand vous l'êtes
Arrêtez de payer par développeur.
Commencez à fermer la boucle.
Plexicus est l'ASPM natif IA qui scanne, filtre, corrige, penteste et explique — de façon autonome. Développeurs illimités, dépôts illimités, actions IA à usage équitable. Vrai niveau gratuit, €269/mo annuel quand vous êtes prêt.