Double Free - Revision history

Christina Schelin: Redirecting from here to Doubly_freeing_memory, since they're effectively the same thing.

2018-12-29T15:22:01Z

Redirecting from here to Doubly_freeing_memory, since they're effectively the same thing.

Mark Burnett: Fixed incomplete sentence.

2014-06-25T00:16:12Z

Fixed incomplete sentence.

Michael Hendrickx at 19:17, 2 June 2014

2014-06-02T19:17:11Z

Michael Hendrickx at 12:47, 2 June 2014

2014-06-02T12:47:28Z

KirstenS: /* References */

2009-02-21T18:10:19Z

‎References

KirstenS at 00:36, 21 February 2009

2009-02-21T00:36:35Z

KirstenS at 02:14, 18 February 2009

2009-02-18T02:14:30Z

KirstenS at 12:52, 30 October 2008

2008-10-30T12:52:02Z

KirstenS at 22:56, 23 September 2008

2008-09-23T22:56:32Z

SergioMoretto: Remove Java category (free doesnt exist in Java)

2007-01-03T16:12:22Z

Remove Java category (free doesnt exist in Java)

← Older revision		Revision as of 15:22, 29 December 2018
Line 1:		Line 1:
−	~~{{Template:Vulnerability}}~~	+	#REDIRECT [[Doubly_freeing_memory]]
−	~~{{Template:Fortify}}~~
−
−	~~Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''~~
−
−	[[~~ASDR_TOC_Vulnerabilities\|Vulnerabilities Table of Contents]]~~
−
−	~~==Description==~~
−
−	~~Double free errors occur when free() is called more than once with the same memory address as an argument.~~
−
−	Calling free() twice on the same value can lead to memory leak. When a program calls free() twice with the same argument, the program's memory management data structures become corrupted and could allow a malicious user to write values in arbitrary memory spaces. This corruption can cause the program to crash or, in some circumstances, alter the execution flow. By overwriting particular registers or memory spaces, an attacker can trick the program into executing code of his/her own choosing, often resulting in an interactive shell with elevated permissions.
−
−	When a buffer is free()'d, a linked list of free buffers is read to rearrange and combine the chunks of free memory (to be able to allocate larger buffers in the future). These chunks are laid out in a double linked list which points to previous and next chunks. Unlinking an unused buffer (which is what happens when free() is called) could allow an attacker to write arbitrary values in memory; essentially overwriting valuable registers, calling shellcode from it's own buffer.
−
−	~~==Risk Factors==~~
−
−	* Talk about the [[OWASP Risk Rating Methodology\|factors]] that make this vulnerability likely or unlikely to actually happen
−	* Discuss the technical impact of a successful exploit of this vulnerability
−	* Consider the likely [business impacts] of a successful attack
−
−
−	~~==Examples==~~
−
−	~~The following code shows a simple example of a double free vulnerability.~~
−
−	~~<pre>~~
−	~~char* ptr = (char*)malloc (SIZE);~~
−	~~...~~
−	~~if (abrt) {~~
−	~~free(ptr);~~
−	}
−	~~...~~
−	~~free(ptr);~~
−	~~</pre>~~
−
−	~~Double free vulnerabilities have three common (and sometimes overlapping) causes:~~
−
−	* Error conditions and other exceptional circumstances
−	* Usage of the memory space after it's freed.
−	* Confusion over which part of the program is responsible for freeing the memory
−
−	Although some double free vulnerabilities are not much more complicated than the previous example, most are spread out across hundreds of lines of code or even different files. Programmers seem particularly susceptible to freeing global variables more than once.
−
−
−
−	~~==Related [[Attacks]]==~~
−
−	* [[Heap_overflow]]
−	* [[Buffer_overflow_attack]]
−
−
−	~~==Related [[Vulnerabilities]]==~~
−
−	* [[Vulnerability 1]]
−	* [[Vulnerabiltiy 2]]
−
−
−	~~==Related [[Controls]]==~~
−
−	* [[Control 1]]
−	* [[Control 2]]
−
−
−	~~==Related [[Technical Impacts]]==~~
−
−	* [[Technical Impact 1]]
−	* [[Technical Impact 2]]
−
−
−	~~==References==~~
−	~~TBD~~
−
−	~~[[Category:FIXME\|add links~~
−
−	~~In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki>~~
−
−	~~Availability Vulnerability~~
−
−	~~Authorization Vulnerability~~
−
−	~~Authentication Vulnerability~~
−
−	~~Concurrency Vulnerability~~
−
−	~~Configuration Vulnerability~~
−
−	~~Cryptographic Vulnerability~~
−
−	~~Encoding Vulnerability~~
−
−	~~Error Handling Vulnerability~~
−
−	~~Input Validation Vulnerability~~
−
−	~~Logging and Auditing Vulnerability~~
−
−	~~Session Management Vulnerability]]~~
−
−	~~__NOTOC__~~
−
−
−	~~[[Category:OWASP ASDR Project]]~~
−	~~[[Category:Code Quality Vulnerability]]~~
−	~~[[Category:Implementation]]~~
−	~~[[Category:Code Snippet]]~~
−	~~[[Category:Vulnerability~~]]

@@ Line 10: / Line 10: @@
 Double free errors occur when free() is called more than once with the same memory address as an argument.
-Calling free() twice on the same value can lead to memory leak. When a program calls free() twice with the same argument, the program's memory management data structures become corrupted and could allow a malicious user to write values in arbitrary memory spaces. This corruption can cause the program to crash or, in some circumstances, alter the execution flow.  By overwriting particular registers or memory spaces, an attacker can trick the program into executing code of his/her own choosing, often resulting in an interactive shell with elevated .
+Calling free() twice on the same value can lead to memory leak. When a program calls free() twice with the same argument, the program's memory management data structures become corrupted and could allow a malicious user to write values in arbitrary memory spaces. This corruption can cause the program to crash or, in some circumstances, alter the execution flow.  By overwriting particular registers or memory spaces, an attacker can trick the program into executing code of his/her own choosing, often resulting in an interactive shell with elevated permissions.
 When a buffer is free()'d, a linked list of free buffers is read to rearrange and combine the chunks of free memory (to be able to allocate larger buffers in the future).  These chunks are laid out in a double linked list which points to previous and next chunks.  Unlinking an unused buffer (which is what happens when free() is called) could allow an attacker to write arbitrary values in memory; essentially overwriting valuable registers, calling shellcode from it's own buffer.

@@ Line 10: / Line 10: @@
 Double free errors occur when free() is called more than once with the same memory address as an argument.
-Calling free() twice on the same value can lead to memory leak. When a program calls free() twice with the same argument, the program's memory management data structures become corrupted and could allow a malicious user to write values in arbitrary memory spaces. This corruption can cause the program to crash or, in some circumstances, alter the execution flow.  By overwriting particular registers or memory spaces, an attacker can trick the program into executing code of his/her own choosing.
+Calling free() twice on the same value can lead to memory leak. When a program calls free() twice with the same argument, the program's memory management data structures become corrupted and could allow a malicious user to write values in arbitrary memory spaces. This corruption can cause the program to crash or, in some circumstances, alter the execution flow.  By overwriting particular registers or memory spaces, an attacker can trick the program into executing code of his/her own choosing, often resulting in an interactive shell with elevated .
 ==Risk Factors==
@@ Line 34: / Line 35: @@
 </pre>
-Double free vulnerabilities have two common (and sometimes overlapping) causes:
+Double free vulnerabilities have three common (and sometimes overlapping) causes:
 * Error conditions and other exceptional circumstances
 * Confusion over which part of the program is responsible for freeing the memory
 Although some double free vulnerabilities are not much more complicated than the previous example, most are spread out across hundreds of lines of code or even different files. Programmers seem particularly susceptible to freeing global variables more than once.
 ==Related [[Attacks]]==
-* [[Attack 1]]
+* [[Heap_overflow]]
-* [[Attack 2]]
+* [[Buffer_overflow_attack]]

← Older revision		Revision as of 12:47, 2 June 2014
Line 10:		Line 10:
	Double free errors occur when free() is called more than once with the same memory address as an argument.		Double free errors occur when free() is called more than once with the same memory address as an argument.

−	Calling free() twice on the same value can lead to ~~a buffer overflow~~. When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, ~~cause two later calls to malloc() to return~~ the ~~same pointer~~. ~~If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated~~ memory, the program ~~becomes vulnerable to a buffer overflow attack~~.	+	Calling free() twice on the same value can lead to memory leak. When a program calls free() twice with the same argument, the program's memory management data structures become corrupted and could allow a malicious user to write values in arbitrary memory spaces. This corruption can cause the program to crash or, in some circumstances, alter the execution flow. By overwriting particular registers or memory spaces, an attacker can trick the program into executing code of his/her own choosing.

@@ Line 102: / Line 102: @@
 [[Category:Implementation]]
 [[Category:Code Snippet]]
-[Category:Vulnerability]]
+[[Category:Vulnerability]]

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:Fortify}}
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
+[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 ==Description==

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+__TOC__
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
-[[ASDR Table of Contents]]
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
@@ Line 108: / Line 108: @@
 [[Category:Implementation]]
 [[Category:Code Snippet]]

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-==Abstract==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 ==Description==
@@ Line 12: / Line 18: @@
 Calling free() twice on the same value can lead to a buffer overflow. When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
 ==Examples ==
 The following code shows a simple example of a double free vulnerability.
@@ Line 33: / Line 47: @@
 Although some double free vulnerabilities are not much more complicated than the previous example, most are spread out across hundreds of lines of code or even different files. Programmers seem particularly susceptible to freeing global variables more than once.
-==Related Attacks==
+==Related [[Attacks]]==
-==Related Countermeasures==
+==Related [[Vulnerabilities]]==
-==Categories==
+* [[Vulnerability 1]]
 [[Category:Code Quality Vulnerability]]
 [[Category:Implementation]]
 [[Category:Code Snippet]]