目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-770 不加限制或调节的资源分配 类漏洞列表 1124

CWE-770 不加限制或调节的资源分配 类弱点 1124 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-770 属于资源管理缺陷，指系统在分配可复用资源时未实施限制或节流措施。攻击者通常通过发送大量请求耗尽系统资源，导致拒绝服务或性能瘫痪。开发者应通过设置并发上限、实施速率限制及监控资源使用率来缓解风险，确保关键资源分配受到严格管控，防止恶意滥用。

MITRE CWE 官方描述
CWE：CWE-770 未限制或未节流地分配资源（Allocation of Resources Without Limits or Throttling） 英文：产品代表某个行为者（actor）分配可重用资源或一组资源时，未对可分配资源的大小或数量施加任何预期的限制。
常见影响 (1)
AvailabilityDoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
缓解措施 (5)
RequirementsClearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and DesignLimit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and DesignDesign throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place, and it will help the administrator to identify who is committing the abuse. The login application should be protected …
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Architecture and DesignFor any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
代码示例 (2)
This code allocates a socket and forks each time it receives a new connection.
sock=socket(AF_INET, SOCK_STREAM, 0); while (1) { newsock=accept(sock, ...); printf("A connection has been accepted\n"); pid = fork(); }
Bad · C
In the following example a server socket connection is used to accept a request to store data on the local file system using a specified filename. The method openSocketConnection establishes a server socket to accept requests from a client. When a client establishes a connection to this service the getNextMessage method is first used to retrieve from the socket the name of the file to store the da…
int writeDataFromSocketToFile(char *host, int port) { char filename[FILENAME_SIZE]; char buffer[BUFFER_SIZE]; int socket = openSocketConnection(host, port); if (socket < 0) { printf("Unable to open socket connection"); return(FAIL); } if (getNextMessage(socket, filename, FILENAME_SIZE) > 0) { if (openFileToWrite(filename) > 0) { while (getNextMessage(socket, buffer, BUFFER_SIZE) > 0){ if (!(writeToFile(buffer) > 0)) break; } } closeFile(); } closeSocket(socket); }
Bad · C
CVE ID标题CVSS风险等级Published
CVE-2019-16770 Puma 安全漏洞 — puma 5.3 Medium2019-12-05
CVE-2019-10171 Red Hat Enterprise Linux 资源管理错误漏洞 — 389-ds-base 7.5 -2019-08-02
CVE-2019-10163 PowerDNS Authoritative Server 资源管理错误漏洞 — pdns 6.5 -2019-07-30
CVE-2019-11478 Linux kernel资源管理错误漏洞 — Linux kernel 7.5 -2019-06-18
CVE-2019-3882 Linux kernel 资源管理错误漏洞 — kernel 5.5 -2019-04-24
CVE-2018-16846 Red Hat Ceph 输入验证错误漏洞 — ceph 6.5 -2019-01-15
CVE-2018-16865 systemd 缓冲区错误漏洞 — systemd 7.8 -2019-01-11
CVE-2018-16864 systemd 缓冲区错误漏洞 — systemd 7.8 -2019-01-11
CVE-2017-2587 Netpbm 资源管理错误漏洞 — netpbm 5.5 -2018-07-27
CVE-2018-3711 Fastify 安全漏洞 — fastify node module 7.5 -2018-06-07
CVE-2018-3737 sshpk 安全漏洞 — sshpk node module 7.5 -2018-06-07
CVE-2018-3738 protobufjs 安全漏洞 — protobufjs node module 5.5 -2018-06-07
CVE-2017-2613 CloudBees Jenkins 跨站请求伪造漏洞 — jenkins 4.3 -2018-05-15
CVE-2017-15124 QEMU 输入验证错误漏洞 — Qemu 7.5 -2018-01-09

CWE-770（不加限制或调节的资源分配） 是常见的弱点类别，本平台收录该类弱点关联的 1124 条 CVE 漏洞。