Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-416 (释放后使用) — Vulnerability Class 2435

2435 vulnerabilities classified as CWE-416 (释放后使用). AI Chinese analysis included.

CWE-416, Use After Free, is a critical memory safety weakness occurring when a program continues to reference a memory location after it has been deallocated. Attackers typically exploit this vulnerability by freeing an object and then rapidly reallocating that same memory block with attacker-controlled data. Because the original pointer still points to the now-invalid address, the application may inadvertently execute malicious code or corrupt memory structures, often leading to arbitrary code execution or denial of service. To prevent this, developers must rigorously manage memory lifecycles by nullifying pointers immediately after freeing them, ensuring no dangling references remain. Utilizing modern programming languages with automatic garbage collection or employing static analysis tools to detect invalid memory accesses further mitigates the risk, ensuring that freed memory is never accessed again during the program’s execution.

MITRE CWE Description
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Common Consequences (4)
IntegrityModify Memory
The use of previously freed memory may corrupt valid data, if the memory area in question has been allocated and used properly elsewhere.
AvailabilityDoS: Crash, Exit, or Restart
If chunk consolidation occurs after the use of previously freed data, the process may crash when invalid data is used as chunk information.
ConfidentialityRead Memory
Read operations on freed memory can sometimes leak sensitive information instead of causing a crash
Integrity, Confidentiality, AvailabilityExecute Unauthorized Code or Commands
If malicious data is entered before chunk consolidation can take place, it may be possible to take advantage of a write-what-where primitive to execute arbitrary code. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap …
Mitigations (2)
Architecture and DesignChoose a language that provides automatic memory management.
ImplementationWhen freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Effectiveness: Defense in Depth
Examples (2)
The following example demonstrates the weakness.
#include <stdio.h> #include <unistd.h> #define BUFSIZER1 512 #define BUFSIZER2 ((BUFSIZER1/2) - 8) int main(int argc, char **argv) { char *buf1R1; char *buf2R1; char *buf2R2; char *buf3R2; buf1R1 = (char *) malloc(BUFSIZER1); buf2R1 = (char *) malloc(BUFSIZER1); free(buf2R1); buf2R2 = (char *) malloc(BUFSIZER2); buf3R2 = (char *) malloc(BUFSIZER2); strncpy(buf2R1, argv[1], BUFSIZER1-1); free(buf1R1); free(buf2R2); free(buf3R2); }
Bad · C
The following code illustrates a use after free error:
char* ptr = (char*)malloc (SIZE); if (err) { abrt = 1; free(ptr); } ... if (abrt) { logError("operation aborted before commit", ptr); }
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2017-10941 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-10-31
CVE-2017-10945 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-10-31
CVE-2017-10946 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-10-31
CVE-2017-10947 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-10-31
CVE-2017-10948 Foxit Reader 安全漏洞 — Foxit Reader 8.8 -2017-10-31

Vulnerabilities classified as CWE-416 (释放后使用) represent 2435 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.