이름: Improperly Controlled Sequential Memory Allocation

The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

일반 정보

취약점 도입 방식

Implementation

적용 가능한 플랫폼

언어

이름: C (Undetermined)
이름: C++ (Undetermined)
클래스: Not Language-Specific (Undetermined)

일반적인 결과

범위	영향	가능성
Availability	DoS: Resource Consumption (Memory) 참고: Not controlling memory allocation can result in a request for too much system memory, possibly leading to a crash of the application due to out-of-memory conditions, or the consumption of a large amount of memory on the system.

관찰된 예시

참고 자료	설명
CVE-2020-36049	JavaScript-based packet decoder uses concatenation of many small strings, causing out-of-memory (OOM) condition
CVE-2019-20176	Product allocates a new buffer on the stack for each file in a directory, allowing stack exhaustion
CVE-2013-1591	Chain: an integer overflow (CWE-190) in the image size calculation causes an infinite loop (CWE-835) which sequentially allocates buffers without limits (CWE-1325) until the stack is full.

잠재적 완화 방법

Phases : Implementation
Ensure multiple allocations of the same kind of object are properly tracked - possibly across multiple sessions, requests, or messages. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
Phases : Operation
Run the program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

관련 공격 패턴

CAPEC ID	공격 패턴 이름
CAPEC-130	Excessive Allocation An adversary causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request.

제출

이름	조직	날짜	출시일	Version
CWE Content Team	MITRE	2020-12-07 +00:00	2020-12-10 +00:00	4.3

수정 사항

이름	조직	날짜	댓글
CWE Content Team	MITRE	2021-07-20 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes

CWE-1325 상세 정보

CWE-1325