CWE-226: Sensitive Information in Resource Not Removed… | Glexia

Causes

• This example shows how an attacker can take advantage of an incorrect state transition. ,
• The following code calls realloc() on a buffer containing sensitive data: There is an attempt to scrub the sensitive data from memory, but realloc() is used, so it could return a pointer to a different part of memory. The memory that was originally allocated for cleartext_buffer could still contain an uncleared copy of the data.

Remediation

• Architecture and Design,Implementation: During critical state transitions, information not needed in the next state should be removed or overwritten with fixed patterns (such as all 0's) or random data, before the transition to the next state.
• Architecture and Design,Implementation: When releasing, de-allocating, or deleting a resource, overwrite its data and relevant metadata with fixed patterns or random data. Be cautious about complex resource types whose underlying representation might be non-contiguous or change at a low level, such as how a file might be split into different chunks on a file system, even though "logical" file positions are contiguous at the application layer. Such resource types might require invocation of special modes or APIs to tell the underlying operating system to perform the necessary clearing, such as SDelete (Secure Delete) on Windows, although the appropriate functionality might not be available at the application layer.

Detection

• Manual Analysis: Write a known pattern into each sensitive location. Trigger the release of the resource or cause the desired state transition to occur. Read data back from the sensitive locations. If the reads are successful, and the data is the same as the pattern that was originally written, the test fails and the product needs to be fixed. Note that this test can likely be automated.
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Related CWEs

• CWE-1239: Improper Zeroization of Hardware Register
• CWE-1239: Improper Zeroization of Hardware Register
• CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition
• CWE-1301: Insufficient or Incomplete Data Removal within Hardware Component
• CWE-1342: Information Exposure through Microarchitectural State after Transient Execution
• CWE-1342: Information Exposure through Microarchitectural State after Transient Execution
• CWE-201: Insertion of Sensitive Information Into Sent Data
• CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
• CWE-459: Incomplete Cleanup
• CWE-244: Improper Clearing of Heap Memory Before Release ('Heap Inspection')

Related CVEs

Related CVE mappings appear after CVE records are cross-indexed.

ATT&CK Relevance

ATT&CK relevance is shown only when reviewed or responsibly inferred.