CWE-1341 Detalhe

The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.

Modos de Introdução

Implementation

Plataformas Aplicáveis

Linguagem

Name: Java (Undetermined)
Name: Rust (Undetermined)
Class: Not Language-Specific (Undetermined)
Name: C (Undetermined)
Name: C++ (Undetermined)

Sistemas Operacionais

Class: Not OS-Specific (Undetermined)

Arquiteturas

Class: Not Architecture-Specific (Undetermined)

Tecnologias

Class: Not Technology-Specific (Undetermined)

Consequências Comuns

Exemplos Observados

Mitigações Potenciais

Phases : Implementation
Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.
Phases : Implementation
It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed. However, flag-tracking can increase code complexity and requires diligent compliance by the programmer.
Phases : Implementation
When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors. For other APIs, this can lead to application crashes or exceptions, which may still be preferable to corrupting an unintended resource such as memory or data.

Métodos de Detecção

Automated Static Analysis

For commonly-used APIs and resource types, automated tools often have signatures that can spot this issue.

Automated Dynamic Analysis

Some compiler instrumentation tools such as AddressSanitizer (ASan) can indirectly detect some instances of this weakness.

Notas de Mapeamento de Vulnerabilidade

Justificativa : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comentário : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Notas

The terms related to "release" may vary depending on the type of resource, programming language, specification, or framework. "Close" has been used synonymously for the release of resources like file descriptors and file handles. "Return" is sometimes used instead of Release. "Free" is typically used when releasing memory or buffers back into the system for reuse.

Referências

REF-1198

close - Perldoc Browser
https://perldoc.perl.org/functions/close

REF-1199

io - Core tools for working with streams — Python 3.9.7 documentation
https://docs.python.org/3.9/library/io.html#io.IOBase.close

REF-1200

FileOutputStream (Java Platform SE 7 )
https://docs.oracle.com/javase/7/docs/api/java/io/FileOutputStream.html

REF-1201

FileOutputStream (Java SE 11 & JDK 11 )
https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/io/FileOutputStream.html

Submissão

Modificações