CWE•Base•Draft•7 recent CVEs
CWE-226Sensitive Information in Resource Not Removed Before Reuse
Description
The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
[object Object]
Common consequences
- Confidentiality→Read Application Data
Potential mitigations
- Architecture and Design,ImplementationDuring critical state transitions, information not needed in the next state should be removed or overwritten with fixed patterns (such as all 0's) or random data, before the transition to the next state.
- Architecture and Design,ImplementationWhen releasing, de-allocating, or deleting a resource, overwrite its data and relevant metadata with fixed patterns or random data. Be cautious about complex resource types whose underlying representation might be non-contiguous or change at a low level, such as how a file might be split into different chunks on a file system, even though "logical" file positions are contiguous at the application