目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-770 不加限制或调节的资源分配 类漏洞列表 1110

CWE-770 不加限制或调节的资源分配 类弱点 1110 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-770 属于资源管理缺陷，指系统在分配可复用资源时未实施限制或节流措施。攻击者通常通过发送大量请求耗尽系统资源，导致拒绝服务或性能瘫痪。开发者应通过设置并发上限、实施速率限制及监控资源使用率来缓解风险，确保关键资源分配受到严格管控，防止恶意滥用。

MITRE CWE 官方描述
CWE：CWE-770 未限制或未节流地分配资源（Allocation of Resources Without Limits or Throttling） 英文：产品代表某个行为者（actor）分配可重用资源或一组资源时，未对可分配资源的大小或数量施加任何预期的限制。
常见影响 (1)
AvailabilityDoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
缓解措施 (5)
RequirementsClearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and DesignLimit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and DesignDesign throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place, and it will help the administrator to identify who is committing the abuse. The login application should be protected …
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Architecture and DesignFor any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
代码示例 (2)
This code allocates a socket and forks each time it receives a new connection.
sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }
Bad · C
In the following example a server socket connection is used to accept a request to store data on the local file system using a specified filename. The method openSocketConnection establishes a server socket to accept requests from a client. When a client establishes a connection to this service the getNextMessage method is first used to retrieve from the socket the name of the file to store the da…
int writeDataFromSocketToFile(char *host, int port) { char filename[FILENAME_SIZE]; char buffer[BUFFER_SIZE]; int socket = openSocketConnection(host, port); if (socket < 0) { printf("Unable to open socket connection"); return(FAIL); } if (getNextMessage(socket, filename, FILENAME_SIZE) > 0) { if (openFileToWrite(filename) > 0) { while (getNextMessage(socket, buffer, BUFFER_SIZE) > 0){ if (!(writeToFile(buffer) > 0)) break; } } closeFile(); } closeSocket(socket); }
Bad · C
CVE ID标题CVSS风险等级Published
CVE-2024-41175 Beckhoff TwinCAT/BSD 安全漏洞 — IPC Diagnostics package 5.5 Medium2024-08-27
CVE-2024-43410 Russh 安全漏洞 — russh 7.5 High2024-08-21
CVE-2024-6098 PTC Kepware ThingWorx Kepware Server 安全漏洞 — Kepware ThingWorx Kepware Server 5.3 Medium2024-08-16
CVE-2024-6004 Lenovo printers 安全漏洞 — Printers 6.5 Medium2024-08-16
CVE-2024-5210 Lenovo printers 安全漏洞 — Printers 6.5 Medium2024-08-16
CVE-2024-5209 Lenovo printers 安全漏洞 — Printers 6.5 Medium2024-08-16
CVE-2024-4782 Lenovo printers 安全漏洞 — Printers 6.5 Medium2024-08-16
CVE-2024-4781 Lenovo printers 安全漏洞 — Printers 6.5 Medium2024-08-16
CVE-2024-7113 AVEVA SuiteLink Server 安全漏洞 — SuiteLink Server 4.3AIMediumAI2024-08-13
CVE-2024-36462 Zabbix 安全漏洞 — Zabbix 7.5 High2024-08-09
CVE-2024-39944 Dahua NVR 安全漏洞 — IPC-HX8XXX and NVR4XXX 7.5 High2024-07-31
CVE-2024-6504 Rapid7 InsightVM 安全漏洞 — InsightVM 4.3 Medium2024-07-18
CVE-2024-38535 Suricata 安全漏洞 — suricata 7.5 High2024-07-11
CVE-2024-38534 Suricata 安全漏洞 — suricata 7.5 High2024-07-11
CVE-2024-6037 ChuanhuChatGPT 资源管理错误漏洞 — gaizhenbiao/chuanhuchatgpt 9.1AICriticalAI2024-07-10
CVE-2024-6598 KNIME Business Hub 安全漏洞 — KNIME Business Hub 4.9AIMediumAI2024-07-09
CVE-2024-39876 Siemens SINEMA Remote Connect Server 安全漏洞 — SINEMA Remote Connect Server 4.0 Medium2024-07-09
CVE-2024-37298 schema 安全漏洞 — schema 7.5 High2024-07-01
CVE-2024-38528 ntpd-rs 安全漏洞 — ntpd-rs 7.5 High2024-06-28
CVE-2024-31919 IBM MQ 安全漏洞 — MQ 5.9 Medium2024-06-28
CVE-2024-6176 LG SuperSign CMS 安全漏洞 — LG SuperSign CMS--AI2024-06-20
CVE-2024-5208 AnythingLLM 安全漏洞 — mintplex-labs/anything-llm 6.5AIMediumAI2024-06-19
CVE-2024-37309 CrateDB 安全漏洞 — crate 5.3 Medium2024-06-13
CVE-2024-31881 IBM Db2 安全漏洞 — Db2 for Linux, UNIX and Windows 6.5 Medium2024-06-12
CVE-2024-28762 IBM DB2 安全漏洞 — Db2 for Linux, UNIX and Windows 5.3 Medium2024-06-12
CVE-2024-32871 Pimcore 安全漏洞 — pimcore 7.5 High2024-06-04
CVE-2024-36378 JetBrains TeamCity 安全漏洞 — TeamCity 5.9 Medium2024-05-29
CVE-2024-35238 Minder 安全漏洞 — minder 5.3 Medium2024-05-27
CVE-2024-35231 Contributed Rack Middleware and Utilities 安全漏洞 — rack-contrib 8.6 High2024-05-27
CVE-2024-2874 GitLab CE/EE 安全漏洞 — GitLab 6.5 Medium2024-05-23

CWE-770（不加限制或调节的资源分配） 是常见的弱点类别，本平台收录该类弱点关联的 1110 条 CVE 漏洞。