CWE-401
AllowedMissing Release of Memory after Effective Lifetime
Abstraction: Variant · Status: Draft
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
2178 vulnerabilities reference this CWE, most recent first.
GHSA-W299-FQ8V-QVG7
Vulnerability from github – Published: 2026-01-27 12:31 – Updated: 2026-01-27 12:31Missing Release of Memory after Effective Lifetime vulnerability in Is-Daouda is-Engine.This issue affects is-Engine: before 3.3.4.
{
"affected": [],
"aliases": [
"CVE-2026-24828"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-27T10:15:49Z",
"severity": "HIGH"
},
"details": "Missing Release of Memory after Effective Lifetime vulnerability in Is-Daouda is-Engine.This issue affects is-Engine: before 3.3.4.",
"id": "GHSA-w299-fq8v-qvg7",
"modified": "2026-01-27T12:31:18Z",
"published": "2026-01-27T12:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24828"
},
{
"type": "WEB",
"url": "https://github.com/Is-Daouda/is-Engine/pull/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W29X-26QV-FMMQ
Vulnerability from github – Published: 2024-05-17 15:31 – Updated: 2025-01-14 15:30In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
When ida_alloc_max fails, resources allocated before should be freed, including *res allocated by kmalloc and ttm_resource_init.
{
"affected": [],
"aliases": [
"CVE-2023-52662"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-17T14:15:08Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node\n\nWhen ida_alloc_max fails, resources allocated before should be freed,\nincluding *res allocated by kmalloc and ttm_resource_init.",
"id": "GHSA-w29x-26qv-fmmq",
"modified": "2025-01-14T15:30:49Z",
"published": "2024-05-17T15:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52662"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/03b1072616a8f7d6e8594f643b416a9467c83fbf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/40624af6674745e174c754a20d7c53c250e65e7a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6fc6233f6db1579b69b54b44571f1a7fde8186e6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/83e0f220d1e992fa074157fcf14945bf170ffbc5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/89709105a6091948ffb6ec2427954cbfe45358ce"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d1e546ab91c670e536a274a75481034ab7534876"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W2F8-JF7V-2CJ4
Vulnerability from github – Published: 2022-08-24 00:00 – Updated: 2022-08-28 00:00A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.
{
"affected": [],
"aliases": [
"CVE-2021-3905"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-23T16:15:00Z",
"severity": "HIGH"
},
"details": "A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.",
"id": "GHSA-w2f8-jf7v-2cj4",
"modified": "2022-08-28T00:00:32Z",
"published": "2022-08-24T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3905"
},
{
"type": "WEB",
"url": "https://github.com/openvswitch/ovs-issues/issues/226"
},
{
"type": "WEB",
"url": "https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2021-3905"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2019692"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202311-16"
},
{
"type": "WEB",
"url": "https://ubuntu.com/security/CVE-2021-3905"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W2RG-V998-6982
Vulnerability from github – Published: 2022-05-24 17:18 – Updated: 2022-05-24 17:18A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will trigger a memory leak, whereby Amarok 2.8.0 continue to waste resources over time, eventually allows attackers to cause a denial of service.
{
"affected": [],
"aliases": [
"CVE-2020-13152"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-20T13:15:00Z",
"severity": "MODERATE"
},
"details": "A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will trigger a memory leak, whereby Amarok 2.8.0 continue to waste resources over time, eventually allows attackers to cause a denial of service.",
"id": "GHSA-w2rg-v998-6982",
"modified": "2022-05-24T17:18:11Z",
"published": "2022-05-24T17:18:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13152"
},
{
"type": "WEB",
"url": "https://r00texpl0it.wordpress.com/2020/05/20/kde-amarok-2-8-0-allows-remote-attackers-to-cause-a-denial-of-service"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/159898/Amarok-2.8.0-Denial-Of-Service.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W2X4-6HP6-4HC7
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-07-15 15:32In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open
ksmbd_lookup_fd_cguid() returns a ksmbd_file with its refcount incremented via ksmbd_fp_get(). parse_durable_handle_context() in the DURABLE_REQ_V2 case properly releases this reference on every path inside the ClientGUID-match branch, either by calling ksmbd_put_durable_fd() or by transferring ownership to dh_info->fp for a successful reconnect. However, when an entry exists in the global file table with the same CreateGuid but a different ClientGUID, the code simply falls through to the new-open path without dropping the reference obtained from ksmbd_lookup_fd_cguid().
Per MS-SMB2 section 3.3.5.9.10 ("Handling the SMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 Create Context"), the server MUST locate an Open whose Open.CreateGuid matches the request's CreateGuid AND whose Open.ClientGuid matches the ClientGuid of the connection that received the request. If no such Open is found, the server MUST continue with the normal open execution phase. A CreateGuid hit with a ClientGUID mismatch is therefore the "Open not found" case: proceeding with a new open is correct, but the reference obtained purely as a side effect of the lookup must not be leaked.
Repeated requests that hit this mismatch pin global_ft entries, prevent __ksmbd_close_fd() from ever running for the corresponding files, and defeat the durable scavenger, leading to long-lived resource leaks.
Release the reference in the mismatch path and clear dh_info->fp so subsequent logic does not mistake a non-matching lookup result for a reconnect target.
{
"affected": [],
"aliases": [
"CVE-2026-52996"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:10Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open\n\nksmbd_lookup_fd_cguid() returns a ksmbd_file with its refcount\nincremented via ksmbd_fp_get(). parse_durable_handle_context() in\nthe DURABLE_REQ_V2 case properly releases this reference on every\npath inside the ClientGUID-match branch, either by calling\nksmbd_put_durable_fd() or by transferring ownership to dh_info-\u003efp\nfor a successful reconnect. However, when an entry exists in the\nglobal file table with the same CreateGuid but a different\nClientGUID, the code simply falls through to the new-open path\nwithout dropping the reference obtained from ksmbd_lookup_fd_cguid().\n\nPer MS-SMB2 section 3.3.5.9.10 (\"Handling the\nSMB2_CREATE_DURABLE_HANDLE_REQUEST_V2 Create Context\"), the server\nMUST locate an Open whose Open.CreateGuid matches the request\u0027s\nCreateGuid AND whose Open.ClientGuid matches the ClientGuid of the\nconnection that received the request. If no such Open is found, the\nserver MUST continue with the normal open execution phase. A\nCreateGuid hit with a ClientGUID mismatch is therefore the\n\"Open not found\" case: proceeding with a new open is correct, but\nthe reference obtained purely as a side effect of the lookup must\nnot be leaked.\n\nRepeated requests that hit this mismatch pin global_ft entries,\nprevent __ksmbd_close_fd() from ever running for the corresponding\nfiles, and defeat the durable scavenger, leading to long-lived\nresource leaks.\n\nRelease the reference in the mismatch path and clear dh_info-\u003efp so\nsubsequent logic does not mistake a non-matching lookup result for\na reconnect target.",
"id": "GHSA-w2x4-6hp6-4hc7",
"modified": "2026-07-15T15:32:43Z",
"published": "2026-06-24T18:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52996"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/06f709d0e531f3e54d88665dd426be3998a774e6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/407b6e699ba8b45b72cc265eed8a1bc8a7191609"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/804054d19886ac6628883d82410f6ee42a818664"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8c4a0ef19c8264c150833131af34541495832cd0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f31beef633fbf2b5af7805fa187a10bcff1d4b49"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W3J5-QJF6-G9GF
Vulnerability from github – Published: 2022-05-01 02:14 – Updated: 2022-05-01 02:14Memory leak in the request_key_auth_destroy function in request_key_auth in Linux kernel 2.6.10 up to 2.6.13 allows local users to cause a denial of service (memory consumption) via a large number of authorization token keys.
{
"affected": [],
"aliases": [
"CVE-2005-3119"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-10-12T13:03:00Z",
"severity": "LOW"
},
"details": "Memory leak in the request_key_auth_destroy function in request_key_auth in Linux kernel 2.6.10 up to 2.6.13 allows local users to cause a denial of service (memory consumption) via a large number of authorization token keys.",
"id": "GHSA-w3j5-qjf6-g9gf",
"modified": "2022-05-01T02:14:37Z",
"published": "2022-05-01T02:14:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-3119"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11236"
},
{
"type": "WEB",
"url": "http://linux.bkbits.net:8080/linux-2.6/cset%4043483fddCiQX1WyG_orbko06TrjMVA"
},
{
"type": "WEB",
"url": "http://linux.bkbits.net:8080/linux-2.6/cset@43483fddCiQX1WyG_orbko06TrjMVA"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/17114"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/17364"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2005-808.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/15076"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-W3PX-8QW9-WJ6X
Vulnerability from github – Published: 2024-03-01 00:30 – Updated: 2024-12-10 18:31In the Linux kernel, the following vulnerability has been resolved:
soundwire: stream: fix memory leak in stream config error path
When stream config is failed, master runtime will release all slave runtime in the slave_rt_list, but slave runtime is not added to the list at this time. This patch frees slave runtime in the config error path to fix the memory leak.
{
"affected": [],
"aliases": [
"CVE-2021-47020"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T23:15:07Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoundwire: stream: fix memory leak in stream config error path\n\nWhen stream config is failed, master runtime will release all\nslave runtime in the slave_rt_list, but slave runtime is not\nadded to the list at this time. This patch frees slave runtime\nin the config error path to fix the memory leak.",
"id": "GHSA-w3px-8qw9-wj6x",
"modified": "2024-12-10T18:31:06Z",
"published": "2024-03-01T00:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47020"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2f17ac005b320c85d686088cfd4c2e7017912b88"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/342260fe821047c3d515e3d28085d73fbdce3e80"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/48f17f96a81763c7c8bf5500460a359b9939359f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7c468deae306d0cbbd539408c26cfec04c66159a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/870533403ffa28ff63e173045fc5369365642002"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/effd2bd62b416f6629e18e3ce077c60de14cfdea"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W3Q4-XR8H-32GF
Vulnerability from github – Published: 2022-02-15 00:02 – Updated: 2024-03-21 03:34A Memory Leak vulnerabilty exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicous user obtain sensitive information..
{
"affected": [],
"aliases": [
"CVE-2021-45346"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-14T19:15:00Z",
"severity": "MODERATE"
},
"details": "A Memory Leak vulnerabilty exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicous user obtain sensitive information..",
"id": "GHSA-w3q4-xr8h-32gf",
"modified": "2024-03-21T03:34:11Z",
"published": "2022-02-15T00:02:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45346"
},
{
"type": "WEB",
"url": "https://github.com/guyinatuxedo/sqlite3_record_leaking"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220303-0001"
},
{
"type": "WEB",
"url": "https://sqlite.org/forum/forumpost/056d557c2f8c452ed5"
},
{
"type": "WEB",
"url": "https://sqlite.org/forum/forumpost/53de8864ba114bf6"
},
{
"type": "WEB",
"url": "https://www.sqlite.org/cves.html#status_of_recent_sqlite_cves"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W3WG-MHJG-F88W
Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-06-16 03:30In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
In amdgpu_acpi_enumerate_xcc(), if amdgpu_acpi_dev_init() returns -ENOMEM, the function returns directly without releasing the allocated xcc_info, resulting in a memory leak.
Fix this by ensuring that xcc_info is properly freed in the error paths.
Compile tested only. Issue found using a prototype static analysis tool and code review.
{
"affected": [],
"aliases": [
"CVE-2026-45947"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-27T14:17:11Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()\n\nIn amdgpu_acpi_enumerate_xcc(), if amdgpu_acpi_dev_init() returns -ENOMEM,\nthe function returns directly without releasing the allocated xcc_info,\nresulting in a memory leak.\n\nFix this by ensuring that xcc_info is properly freed in the error paths.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review.",
"id": "GHSA-w3wg-mhjg-f88w",
"modified": "2026-06-16T03:30:32Z",
"published": "2026-05-27T15:33:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45947"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/18a7bbd11f17a7cd4c42fd5955d3675d68c692df"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7e4b612fe7a960d610c20260c9ee220bddd1b215"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c9be63d565789b56ca7b0197e2cb78a3671f95a8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d1370ef2ecf7d4df25e3e1e430cd191b1e7f8596"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e87c73a80a12d337cf5f493c0956f6c2c9eafd80"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W3X6-6F6F-54F3
Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-06-16 03:30In the Linux kernel, the following vulnerability has been resolved:
s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
css_alloc_subchannel() calls device_initialize() before setting up
the DMA masks. If dma_set_coherent_mask() or dma_set_mask() fails,
the error path frees the subchannel structure directly, bypassing
the device model reference counting.
Once device_initialize() has been called, the embedded struct device
must be released via put_device(), allowing the release callback to
free the container structure.
Fix the error path by dropping the initial device reference with
put_device() instead of calling kfree() directly.
This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues.
{
"affected": [],
"aliases": [
"CVE-2026-45981"
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-27T14:17:15Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cio: Fix device lifecycle handling in css_alloc_subchannel()\n\n`css_alloc_subchannel()` calls `device_initialize()` before setting up\nthe DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails,\nthe error path frees the subchannel structure directly, bypassing\nthe device model reference counting.\n\nOnce `device_initialize()` has been called, the embedded struct device\nmust be released via `put_device()`, allowing the release callback to\nfree the container structure.\n\nFix the error path by dropping the initial device reference with\n`put_device()` instead of calling `kfree()` directly.\n\nThis ensures correct device lifetime handling and avoids potential\nuse-after-free or double-free issues.",
"id": "GHSA-w3x6-6f6f-54f3",
"modified": "2026-06-16T03:30:33Z",
"published": "2026-05-27T15:33:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45981"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2b2ad7ad4a28ffdb9f94e6d979b88a5b12b71681"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6715560527e343a387e4a0d2e6c401748e89fa55"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/abb6e07f46a740cda4f07d1b561ae4eaa7a1df42"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b1d4e6fb241672850296956c4d782a69363a3807"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c35cfbb5341ba05ad1b4476ffc3c21cc3ff8f603"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fd295a75d828c11acfcc6869c2a12cdaaf9b7722"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-41
Strategy: Libraries or Frameworks
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
- For example, glibc in Linux provides protection against free of invalid pointers.
- When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
- To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
Mitigation
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
No CAPEC attack patterns related to this CWE.