Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-416 (释放后使用) — Vulnerability Class 2435

2435 vulnerabilities classified as CWE-416 (释放后使用). AI Chinese analysis included.

CWE-416, Use After Free, is a critical memory safety weakness occurring when a program continues to reference a memory location after it has been deallocated. Attackers typically exploit this vulnerability by freeing an object and then rapidly reallocating that same memory block with attacker-controlled data. Because the original pointer still points to the now-invalid address, the application may inadvertently execute malicious code or corrupt memory structures, often leading to arbitrary code execution or denial of service. To prevent this, developers must rigorously manage memory lifecycles by nullifying pointers immediately after freeing them, ensuring no dangling references remain. Utilizing modern programming languages with automatic garbage collection or employing static analysis tools to detect invalid memory accesses further mitigates the risk, ensuring that freed memory is never accessed again during the program’s execution.

MITRE CWE Description
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Common Consequences (4)
IntegrityModify Memory
The use of previously freed memory may corrupt valid data, if the memory area in question has been allocated and used properly elsewhere.
AvailabilityDoS: Crash, Exit, or Restart
If chunk consolidation occurs after the use of previously freed data, the process may crash when invalid data is used as chunk information.
ConfidentialityRead Memory
Read operations on freed memory can sometimes leak sensitive information instead of causing a crash
Integrity, Confidentiality, AvailabilityExecute Unauthorized Code or Commands
If malicious data is entered before chunk consolidation can take place, it may be possible to take advantage of a write-what-where primitive to execute arbitrary code. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap …
Mitigations (2)
Architecture and DesignChoose a language that provides automatic memory management.
ImplementationWhen freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Effectiveness: Defense in Depth
Examples (2)
The following example demonstrates the weakness.
#include <stdio.h> #include <unistd.h> #define BUFSIZER1 512 #define BUFSIZER2 ((BUFSIZER1/2) - 8) int main(int argc, char **argv) { char *buf1R1; char *buf2R1; char *buf2R2; char *buf3R2; buf1R1 = (char *) malloc(BUFSIZER1); buf2R1 = (char *) malloc(BUFSIZER1); free(buf2R1); buf2R2 = (char *) malloc(BUFSIZER2); buf3R2 = (char *) malloc(BUFSIZER2); strncpy(buf2R1, argv[1], BUFSIZER1-1); free(buf1R1); free(buf2R2); free(buf3R2); }
Bad · C
The following code illustrates a use after free error:
char* ptr = (char*)malloc (SIZE); if (err) { abrt = 1; free(ptr); } ... if (abrt) { logError("operation aborted before commit", ptr); }
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2018-9967 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2018-05-17
CVE-2018-9968 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2018-05-17
CVE-2018-9969 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2018-05-17
CVE-2018-9970 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2018-05-17
CVE-2018-9975 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2018-05-17
CVE-2018-9977 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2018-05-17
CVE-2018-8843 Rockwell Automation Arena 资源管理错误漏洞 — Rockwell Automation Arena 5.5 -2018-05-14
CVE-2017-1081 FreeBSD ipfilter 输入验证漏洞 — FreeBSD 7.5 -2018-04-10
CVE-2018-0170 Cisco IOS XE Software 安全漏洞 — Cisco IOS XE 7.5 -2018-03-28
CVE-2018-7521 Omron CX-Supervisor 缓冲区错误漏洞 — Omron CX-Supervisor 5.3 -2018-03-21
CVE-2017-16749 Delta Industrial Automation Screen Editor 安全漏洞 — Delta Electronics Delta Industrial Automation Screen Editor 7.8 -2018-03-15
CVE-2016-9591 JasPer 安全漏洞 — jasper 5.5 -2018-03-09
CVE-2018-1166 Joyent SmartOS 安全漏洞 — Joyent SmartOS 7.0 -2018-02-21
CVE-2017-16732 Advantech WebAccess 资源管理错误漏洞 — Advantech WebAccess 8.6 -2018-01-12
CVE-2017-10957 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-10958 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-10959 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-14831 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-14832 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-14833 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-14834 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-14836 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-16575 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-16576 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-16577 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-16581 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-16583 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-16585 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-16586 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20
CVE-2017-16587 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-12-20

Vulnerabilities classified as CWE-416 (释放后使用) represent 2435 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.