CWE-675: Multiple Operations on Resource in… | Glexia
CWE-675 (Multiple Operations on Resource in Single-Operation Context) weakness overview with consequences, detection methods, mitigations, related CVEs and MITRE…
Glexia's Take · Automated analysis
CWE-675: Multiple Operations on Resource in Single-Operation Context
Multiple Operations on Resource in Single-Operation Context represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Executive Impact
- Other: Other
Developer Pattern
CWE-675 is the kind of defect developers can usually prevent with explicit validation, safer framework defaults, and tests that exercise hostile input or unsafe state transitions.
Automation confidence
high confidence from CWE-675, 4.20.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Official CWE Definition
CWE-675: Multiple Operations on Resource in Single-Operation Context
The product performs the same operation on a resource two or more times, when the operation should only be applied once.
Developer And Remediation Guidance
How teams prevent and detect this weakness
Causes
- The following code shows a simple example of a double free vulnerability. Double free vulnerabilities have two common (and sometimes overlapping) causes: Error conditions and other exceptional circumstances Confusion over which part of the program is responsible for freeing the memory Although some double free vulnerabilities are not much more complicated than this example, most are spread out across hundreds of lines of code or even different files. Programmers seem particularly susceptible to freeing global variables more than once.
- This code binds a server socket to port 21, allowing the server to listen for traffic on that port. This code may result in two servers binding a socket to same port, thus receiving each other's traffic. This could be used by an attacker to steal packets meant for another process, such as a secure FTP server.
Remediation
- Use safe APIs
- Centralize the control
- Add regression tests
- Review logs and telemetry for attempted abuse
Detection
- Code review
- SAST
- DAST
- Focused regression tests
Mappings
Related CVEs, CWEs, and ATT&CK context
Related CWEs
- CWE-1341: Multiple Releases of Same Resource or Handle
- CWE-174: Double Decoding of the Same Data
- CWE-605: Multiple Binds to the Same Port
- CWE-102: Struts: Duplicate Validation Forms
- CWE-573: Improper Following of Specification by Caller
- CWE-586: Explicit Call to Finalize()
- CWE-764: Multiple Locks of a Critical Resource
- CWE-765: Multiple Unlocks of a Critical Resource
- CWE-85: Doubled Character XSS Manipulations
ATT&CK Relevance
ATT&CK relevance is shown only when reviewed or responsibly inferred.