CWE-666 Class Draft

Operation on Resource in Wrong Phase of Lifetime

This vulnerability occurs when software interacts with a resource—like memory, a file, or a network connection—at an incorrect stage of its existence, leading to crashes, data corruption, or…

Definition

What is CWE-666?

This vulnerability occurs when software interacts with a resource—like memory, a file, or a network connection—at an incorrect stage of its existence, leading to crashes, data corruption, or unpredictable behavior.

Every resource in a program has a distinct lifecycle: it's created (initialized), used for its intended purpose, and finally cleaned up (released). Each of these phases has specific rules. A common mistake is trying to use a resource before it's fully ready—like reading from an uninitialized memory buffer—or after it's been disposed of, such as closing an already-closed file handle. These operations violate the expected sequence and directly cause instability. To prevent this, developers must explicitly manage state. Ensure initialization is complete before use, validate the resource is in an 'active' state for operations, and avoid repeated or premature release. Using design patterns like RAII (Resource Acquisition Is Initialization) or implementing clear state flags can enforce the correct order and make invalid phase transitions obvious bugs during development.

Auswirkungen in der Praxis

Real-world CVEs caused by CWE-666

CVE-2006-5051

Chain: Signal handler contains too much functionality (CWE-828), introducing a race condition (CWE-362) that leads to a double free (CWE-415).

Wie Angreifer es ausnutzen

Angreiferpfad Schritt für Schritt

1
The following code shows a simple example of a double free vulnerability.
2
Double free vulnerabilities have two common (and sometimes overlapping) causes:
3
- Error conditions and other exceptional circumstances - Confusion over which part of the program is responsible for freeing the memory
4
Although some double free vulnerabilities are not much more complicated than this example, most are spread out across hundreds of lines of code or even different files. Programmers seem particularly susceptible to freeing global variables more than once.

Verwundbares Codebeispiel

Vulnerable C

The following code shows a simple example of a double free vulnerability.

Verwundbar C

char* ptr = (char*)malloc (SIZE);
   ...
   if (abrt) { 
  	 free(ptr); 
   }
   ...
   free(ptr);

Sicheres Codebeispiel

Secure pseudo

Sicher pseudo

// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Präventions-Checkliste

How to prevent CWE-666

Architecture and Design Follow the resource's lifecycle from creation to release.

Erkennungssignale

How to detect CWE-666

SAST High

Führe statische Analyse (SAST) auf der Codebasis aus und suche im Datenfluss nach dem unsicheren Muster.

DAST Moderate

Führe dynamische Application-Security-Tests gegen den Live-Endpoint aus.

Runtime Moderate

Beobachte Runtime-Logs auf ungewöhnliche Exception-Traces, fehlerhafte Eingaben oder Versuche, Autorisierung zu umgehen.

Code review Moderate

Code Review: Markiere jeden neuen Code, der Eingaben von dieser Oberfläche ohne validierte Framework-Helper verarbeitet.

CWE-666

Don't catalog this weakness. Prove it's reachable.

Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.

Request AI Swarm Pentest

Häufig gestellte Fragen

Frequently asked questions

Was ist CWE-666?

Wie gravierend ist CWE-666?

MITRE hat für diese Schwachstelle keine Exploit-Wahrscheinlichkeit veröffentlicht. Behandle sie als mittlere Auswirkung, bis dein Threat Model anderes belegt.

Welche Sprachen oder Plattformen sind von CWE-666 betroffen?

MITRE hat für diese CWE keine betroffenen Plattformen spezifiziert — sie kann in den meisten Anwendungs-Stacks auftreten.

Wie kann ich CWE-666 verhindern?

Follow the resource's lifecycle from creation to release.

Wie erkennt und behebt Plexicus CWE-666?

Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-666 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.

Wo erfahre ich mehr über CWE-666?

MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/666.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.

Verwandte Schwachstellen

Weaknesses related to CWE-666

CWE-664 Parent

Bereit zu validieren, was zählt.

Plexicus ist Proof-Driven AppSec: validierte Funde, kontextuelles Verständnis und geprüfte Remediation — in Evidenz verankert, mit Ihnen gescoped.

Pentest buchen

Operation on Resource in Wrong Phase of Lifetime

What is CWE-666?

Real-world CVEs caused by CWE-666

Angreiferpfad Schritt für Schritt

Vulnerable C

Secure pseudo

How to prevent CWE-666

How to detect CWE-666

Don't catalog this weakness. Prove it's reachable.

Frequently asked questions

Weaknesses related to CWE-666

Improper Control of a Resource Through its Lifetime

Incorrect Access of Indexable Resource ('Range Error')

Creation of Emergent Resource

Improper Preservation of Consistency Between Independent Representations of Shared State

Reliance on Component That is Not Updateable

Information Loss or Omission

Incomplete Internal State Distinction

Uncontrolled Resource Consumption

Improper Resource Shutdown or Release

Further reading

Bereit zu validieren, was zählt.

Prüfen Sie, ob AI Swarm Pentest zu Ihrer Umgebung passt.

Anfrage erhalten. Nächsten Schritt buchen.

Sample evidence handover

Server-Side Request Forgery in `webhooks/receiver`