CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Also known as Dangling pointer, UAF, Use-After-Free.
A kind of CWE-825 Expired Pointer Dereference.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn multiple functions of sdp_server.cc, there is a possible use after free due to a logic error...8.8 High
- google androidIn process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a...8.8 High
- google androidIn multiple locations, there is a possible way to execute arbitrary code due to a use after free....8.4 High
- google androidIn rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to...8.4 High
- google androidIn rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a...9.8 Critical
- google androidIn hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due...5.5 Medium
- google androidIn bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution...8.4 High
- google androidIn multiple locations, there is a possible way to execute arbitrary code due to a use after free....8.4 High
- google androidIn avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to...8.4 High
- google androidIn sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary...9.8 Critical
- google androidIn multiple locations, there is a possible out of bounds write due to a use after free. This...8.8 High
- google androidIn process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary...9.8 Critical
- google androidIn process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary...9.8 Critical
- google androidIn btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a...8.0 High
- linux, linux kernel +1 moreax25: rcu protect dev->ax25_ptr7.8 High
- linux, linux kernel +1 morenilfs2: protect access to buffers with no active references7.8 High
- linux, linux kernel +1 morememory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()7.8 High
- linux, linux kernel +1 moreHID: corsair-void: Add missing delayed work cancel for headset status7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenfsd: clear acl_access/acl_default after releasing them9.8 Critical
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morevrf: use RCU protection in l3mdev_l3_out()7.8 High
- linux, linux kernel +1 moreworkqueue: Put the pwq after detaching the rescuer from the pool7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morendisc: use RCU protection in ndisc_alloc_skb()7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreneighbour: use RCU protection in __neigh_notify()7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - bios +1 more +3 morearp: use RCU protection in arp_xmit()8.1 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreopenvswitch: use RCU protection in ovs_vport_cmd_fill_info()7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morendisc: extend RCU protection in ndisc_send_skb()8.1 High
- linux, linux kernel +1 moreipv6: mcast: extend RCU protection in igmp6_send()7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +3 more +5 morevsock: Keep the binding until socket destruction7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morescsi: ufs: bsg: Set bsg_queue to NULL after removal7.8 High
- linux, linux kernel +1 moredrm/xe/tracing: Fix a potential TP_printk UAF7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morebtrfs: fix use-after-free when attempting to join an aborted transaction7.8 High
- linux, linux kernel +1 morenet/mlx5: HWS, change error flow on matcher disconnect7.8 High
- linux, linux kernel +1 morescsi: ufs: core: Fix use-after free in init error and remove paths7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreBluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moremedia: uvcvideo: Remove dangling pointers7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenbd: don't allow reconnect after disconnect7.8 High
- linux, linux kernel +1 morewifi: rtw89: fix race between cancel_hw_scan and hw_scan completion7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morepadata: avoid UAF for reorder_work7.8 High
- linux, linux kernel +1 morenilfs2: do not force clear folio if buffer is referenced7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: rose: fix timer races against user threads7.8 High
- linux, linux kernel +1 morenet: davicom: fix UAF in dm9000_drv_remove7.8 High
- linux, linux kernel +1 moreRDMA/mlx5: Fix implicit ODP use after free7.8 High
- linux, linux kernel +1 morewifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()8.8 High
- linux, linux kernel +1 morei3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morepps: Fix a use-after-free7.8 High
- linux, linux kernel +1 moretty: goldfish: Fix free_irq() on remove7.8 High
- linux, linux kernel +1 morebus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()7.8 High
- linux, linux kernel +1 moretipc: fix use-after-free Read in tipc_named_reinit7.8 High
- linux, linux kernel +1 moreblock: disable the elevator int del_gendisk7.8 High
- linux, linux kernel +1 moreiio: trigger: sysfs: fix use-after-free on remove7.8 High
- Show moreLoading…