deardaniel/secdata-raw huggingface dataset:
CWE-401: Missing Release of Memory after Effective Lifetime

Description:
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected languages: Not Language-Specific, C, C++
Parent weaknesses: CWE-772, CWE-404, CWE-404

Consequences:
  - Availability: DoS: Crash, Exit, or Restart
  - Other: Reduce Performance

Detection methods:
  - Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with rand
  - Automated Dynamic Analysis: Use tools that are integrated during
			 compilation to insert runtime error-checking mechanisms
			 related to memory safety errors, such as AddressSanitizer
			 (ASan) for C/C++ [REF-1518] or valgri
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone. 
                   For example, glibc in Linux provides protection against free of invalid pointers. 
                   When using Xcode to target OS X or iOS, enable automatic 
  - [Architecture and Design] Use an abstraction library to abstract away risky APIs. Not a complete solution.
  - [Architecture and Design] Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.

Demonstrative examples:
The following C function leaks a block of allocated memory if the call to read() does not return the expected number of bytes:

char* getBlock(int fd) { 
                         char* buf = (char*) malloc(BLOCK_SIZE); if (!buf) { return NULL; } if (read(fd, buf, BLOCK_SIZE) != BLOCK_SIZE) { 
                               
                                  return NULL; 
                            } return buf; 
                      }

Real-world examples:
  - CVE-2005-3119: Memory leak because function does not free() an element of a data structure.
  - CVE-2004-0427: Memory leak when counter variable is not decremented.
  - CVE-2002-0574: chain: reference count is not decremented, leading to memory leak in OS by sending ICMP packets.
  - CVE-2005-3181: Kernel uses wrong function to release a data structure, preventing data from being properly tracked by other code.
  - CVE-2004-0222: Memory leak via unknown manipulations as part of protocol test suite.
CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')

Description:
The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-668

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Real-world examples:
  - CVE-2003-0740: Server leaks a privileged file descriptor, allowing the server to be hijacked.
  - CVE-2004-1033: File descriptor leak allows read of restricted files.
CWE-403: Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')

Description:
A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.

Extended Description:
When a new process is forked or executed, the child process inherits any open file descriptors. When the child process has fewer privileges than the parent process, this might introduce a vulnerability if the child process can access the file descriptor but does not have the privileges to access the associated file.

Affected languages: C, Not Language-Specific
Parent weaknesses: CWE-402

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Real-world examples:
  - CVE-2003-0740: Server leaks a privileged file descriptor, allowing the server to be hijacked.
  - CVE-2004-1033: File descriptor leak allows read of restricted files.
  - CVE-2000-0094: Access to restricted resource using modified file descriptor for stderr.
  - CVE-2002-0638: Open file descriptor used as alternate channel in complex race condition.
  - CVE-2003-0489: Program does not fully drop privileges after creating a file descriptor, which allows access to the descriptor via a separate vulnerability.
CWE-405: Asymmetric Resource Consumption (Amplification)

Description:
The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Extended Description:
This can lead to poor performance due to "amplification" of resource consumption, typically in a non-linear fashion.  This situation is worsened if the product allows malicious users or attackers to consume more resources than their access level permits.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Client Server
Parent weaknesses: CWE-400

Consequences:
  - Availability: DoS: Amplification

Mitigations:
  - [Architecture and Design] An application must make resources available to a client commensurate with the client's access level.
  - [Architecture and Design] An application must, at all times, keep track of allocated resources and meter their usage appropriately.
  - [System Configuration] Consider disabling resource-intensive algorithms on the server side, such as Diffie-Hellman key exchange.

Demonstrative examples:
This code listens on a port for DNS requests and sends the result to the requesting address.
This code sends a DNS record to a requesting IP address. UDP allows the source IP address to be easily changed ('spoofed'), thus allowing an attacker to redirect responses to a target, which may be then be overwhelmed by the network traffic.
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.bind( (UDP_IP,UDP_PORT) ) while true: 
                         data = sock.recvfrom(1024) if not data: break 
                            (requestIP, nameToResolve) = parseUDPpacket(data) record = resolveName(nameToResolve) sendResponse(requestIP,record)

This function prints the contents of a specified file requested by a user.
This code first reads a specified file into memory, then prints the file if the user is authorized to see its contents. The read of the file into memory may be resource intensive and is unnecessary if the user is not allowed to see the file anyway.
function printFile($username,$filename){ 
                         
                            
                            //read file into string 
                            $file = file_get_contents($filename); if ($file && isOwnerOf($username,$filename)){ echo $file; return true; } else{ echo 'You are not authorized to view this file'; } return false; 
                      }

Real-world examples:
  - CVE-1999-0513: Classic "Smurf" attack, using spoofed ICMP packets to broadcast addresses.
  - CVE-2003-1564: Parsing library allows XML bomb
  - CVE-2004-2458: Tool creates directories before authenticating user.
  - CVE-2020-10735: Python has "quadratic complexity" issue when converting string to int with many digits in unexpected bases
  - CVE-2020-5243: server allows ReDOS with crafted User-Agent strings, due to overlapping capture groups that cause excessive backtracking.
CWE-406: Insufficient Control of Network Message Volume (Network Amplification)

Description:
The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

Extended Description:
In the absence of a policy to restrict asymmetric resource consumption, the application or system cannot distinguish between legitimate transmissions and traffic intended to serve as an amplifying attack on target systems. Systems can often be configured to restrict the amount of traffic sent out on behalf of a client, based on the client's origin or access level. This is usually defined in a resource allocation policy. In the absence of a mechanism to keep track of transmissions, the system or application can be easily abused to transmit asymmetrically greater traffic than the request or client should be permitted to.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-405

Consequences:
  - Availability: DoS: Amplification

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] An application must make network resources available to a client commensurate with the client's access level.
  - [Policy] Define a clear policy for network resource allocation and consumption.
  - [Implementation] An application must, at all times, keep track of network resources and meter their usage appropriately.

Demonstrative examples:
This code listens on a port for DNS requests and sends the result to the requesting address.
This code sends a DNS record to a requesting IP address. UDP allows the source IP address to be easily changed ('spoofed'), thus allowing an attacker to redirect responses to a target, which may be then be overwhelmed by the network traffic.
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.bind( (UDP_IP,UDP_PORT) ) while true: 
                         data = sock.recvfrom(1024) if not data: break 
                            (requestIP, nameToResolve) = parseUDPpacket(data) record = resolveName(nameToResolve) sendResponse(requestIP,record)

Real-world examples:
  - CVE-1999-0513: Classic "Smurf" attack, using spoofed ICMP packets to broadcast addresses.
  - CVE-1999-1379: DNS query with spoofed source address causes more traffic to be returned to spoofed address than was sent by the attacker.
  - CVE-2000-0041: Large datagrams are sent in response to malformed datagrams.
  - CVE-1999-1066: Game server sends a large amount.
  - CVE-2013-5211: composite: NTP feature generates large responses (high amplification factor) with spoofed UDP source addresses.
CWE-407: Inefficient Algorithmic Complexity

Description:
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-405

Consequences:
  - Availability: DoS: Resource Consumption (CPU)

Demonstrative examples:
This example attempts to check if an input string is a "sentence" [REF-1164].
The regular expression has a vulnerable backtracking clause inside (\w+\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases. 
	      To fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \2 which prevents the backtracking. The modified example is:
var test_string = "Bad characters: $@#"; 
               var bad_pattern  = /^(\w+\s?)*$/i; 
               var result = test_string.search(bad_pattern);
var test_string = "Bad characters: $@#"; 
               var good_pattern  = /^((?=(\w+))\2\s?)*$/i; 
               var result = test_string.search(good_pattern);

Real-world examples:
  - CVE-2021-32617: C++ library for image metadata has "quadratic complexity" issue with unnecessarily repetitive parsing each time an invalid character is encountered
  - CVE-2020-10735: Python has "quadratic complexity" issue when converting string to int with many digits in unexpected bases
  - CVE-2020-5243: server allows ReDOS with crafted User-Agent strings, due to overlapping capture groups that cause excessive backtracking.
  - CVE-2014-1474: Perl-based email address parser has "quadratic complexity" issue via a string that does not contain a valid address
  - CVE-2003-0244: CPU consumption via inputs that cause many hash table collisions.
CWE-408: Incorrect Behavior Order: Early Amplification

Description:
The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-405, CWE-696

Consequences:
  - Availability: DoS: Amplification

Demonstrative examples:
This function prints the contents of a specified file requested by a user.
This code first reads a specified file into memory, then prints the file if the user is authorized to see its contents. The read of the file into memory may be resource intensive and is unnecessary if the user is not allowed to see the file anyway.
function printFile($username,$filename){ 
                         
                            
                            //read file into string 
                            $file = file_get_contents($filename); if ($file && isOwnerOf($username,$filename)){ echo $file; return true; } else{ echo 'You are not authorized to view this file'; } return false; 
                      }

Real-world examples:
  - CVE-2004-2458: Tool creates directories before authenticating user.
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

Description:
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Extended Description:
An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-405

Consequences:
  - Availability: DoS: Amplification

Demonstrative examples:
The DTD and the very brief XML below illustrate what is meant by an XML bomb. The ZERO entity contains one character, the letter A. The choice of entity name ZERO is being used to indicate length equivalent to that exponent on two, that is, the length of ZERO is 2^0. Similarly, ONE refers to ZERO twice, therefore the XML parser will expand ONE to a length of 2, or 2^1. Ultimately, we reach entity THIRTYTWO, which will expand to 2^32 characters in length, or 4 GB, probably consuming far more data than expected.

<?xml version="1.0"?> <!DOCTYPE MaliciousDTD [ <!ENTITY ZERO "A"> <!ENTITY ONE "&ZERO;&ZERO;"> <!ENTITY TWO "&ONE;&ONE;"> ... <!ENTITY THIRTYTWO "&THIRTYONE;&THIRTYONE;"> ]> <data>&THIRTYTWO;</data>

Real-world examples:
  - CVE-2009-1955: XML bomb in web server module
  - CVE-2003-1564: Parsing library allows XML bomb
CWE-41: Improper Resolution of Path Equivalence

Description:
The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.

Extended Description:
Path equivalence is usually employed in order to circumvent access controls expressed using an incomplete set of file name or file path representations. This is different from path traversal, wherein the manipulations are performed to generate a name for a different object.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-706, CWE-863, CWE-1390

Consequences:
  - Confidentiality: Read Files or Directories

Detection methods:
  - Automated Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Manual Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Dynamic Analysis with Automated Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             

Mitigations:
  - [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. 
                   When pe
  - [Implementation] Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or au
  - [Implementation] Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous i

Real-world examples:
  - CVE-2000-1114: Source code disclosure using trailing dot
  - CVE-2002-1986: Source code disclosure using trailing dot
  - CVE-2004-2213: Source code disclosure using trailing dot or trailing encoding space "%20"
  - CVE-2005-3293: Source code disclosure using trailing dot
  - CVE-2004-0061: Bypass directory access restrictions using trailing dot in URL
CWE-410: Insufficient Resource Pool

Description:
The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

Extended Description:
Frequently the consequence is a "flood" of connection or sessions.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-664

Consequences:
  - Availability: DoS: Crash, Exit, or Restart

Mitigations:
  - [Architecture and Design] Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
  - [Architecture and Design] Consider implementing a velocity check mechanism which would detect abusive behavior.
  - [Operation] Consider load balancing as an option to handle heavy loads.
  - [Implementation] Make sure that resource handles are properly closed when no longer needed.

Demonstrative examples:
In the following snippet from a Tomcat configuration file, a JDBC connection pool is defined with a maximum of 5 simultaneous connections (with a 60 second timeout). In this case, it may be trivial for an attacker to instigate a denial of service (DoS) by using up all of the available connections in the pool.

<Resource name="jdbc/exampledb" auth="Container" type="javax.sql.DataSource" removeAbandoned="true" removeAbandonedTimeout="30" maxActive="5" maxIdle="5" maxWait="60000" username="testuser" [CREDENTIAL_REDACTED]" driverClassName="com.mysql.jdbc.Driver" url="jdbc:mysql://localhost/exampledb"/>

Real-world examples:
  - CVE-1999-1363: Large number of locks on file exhausts the pool and causes crash.
  - CVE-2001-1340: Product supports only one connection and does not disconnect a user who does not provide credentials.
  - CVE-2002-0406: Large number of connections without providing credentials allows connection exhaustion.
CWE-412: Unrestricted Externally Accessible Lock

Description:
The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.

Extended Description:
This prevents the product from acting on associated resources or performing other behaviors that are controlled by the presence of the lock. Relevant locks might include an exclusive lock or mutex, or modifying a shared resource that is treated as a lock. If the lock can be held for an indefinite period of time, then the denial of service could be permanent.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-667

Consequences:
  - Availability: DoS: Resource Consumption (Other)

Detection methods:
  - White Box: Automated code analysis techniques might not be able to reliably detect this weakness, since the application's behavior and general security model dictate which resource locks are critical. Interpreta

Mitigations:
  - [Architecture and Design] Use any access control that is offered by the functionality that is offering the lock.
  - [Architecture and Design] Use unpredictable names or identifiers for the locks. This might not always be possible or feasible.
  - [Architecture and Design] Consider modifying your code to use non-blocking synchronization methods.

Demonstrative examples:
This code tries to obtain a lock for a file, then writes to it.
PHP by default will wait indefinitely until a file lock is released. If an attacker is able to obtain the file lock, this code will pause execution, possibly leading to denial of service for other users. Note that in this case, if an attacker can perform an flock() on the file, they may already have privileges to destroy the log file. However, this still impacts the execution of other programs that depend on flock().
function writeToLog($message){ $logfile = fopen("logFile.log", "a"); 
                         //attempt to get logfile lock 
                         if (flock($logfile, LOCK_EX)) { fwrite($logfile,$message); 
                            // unlock logfile 
                            flock($logfile, LOCK_UN); } e

Real-world examples:
  - CVE-2001-0682: Program can not execute when attacker obtains a mutex.
  - CVE-2002-1914: Program can not execute when attacker obtains a lock on a critical output file.
  - CVE-2002-1915: Program can not execute when attacker obtains a lock on a critical output file.
  - CVE-2002-0051: Critical file can be opened with exclusive read access by user, preventing application of security policy. Possibly related to improper permissions, large-window race condition.
  - CVE-2000-0338: Chain: predictable file names used for locking, allowing attacker to create the lock beforehand. Resultant from permissions and randomness.