CWE-590—Free of Memory not on the Heap

名称

Free of Memory not on the Heap

描述

The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

When free() is called on an invalid pointer, the program's memory management data structures may become corrupted. This corruption can cause the program to crash or, in some circumstances, an attacker may be able to cause free() to operate on controllable memory locations to modify critical program variables or execute code.

常见后果

范围：

Integrity, Confidentiality, Availability

影响：

Execute Unauthorized Code or Commands, Modify Memory

注释：

There is the potential for arbitrary code execution with privileges of the vulnerable program via a "write, what where" primitive. If pointers to memory which hold user information are freed, a malicious user will be able to write 4 bytes anywhere in memory.

相关 CWE

• CWE-123Write-what-where ConditionHigh
• CWE-762Mismatched Memory Management RoutinesLow