CWE-825 Expired Pointer Dereference

The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

• Confidentiality: Read Memory — If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application. • Availability: DoS: Crash, Exit, or Restart — If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur. • Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands — If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.

• [Architecture and Design] Choose a language that provides automatic memory management. • [Implementation] When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) • Automated Dynamic Analysis: Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].

• CVE-2023-26463: Chain: IPSec VPN product uses the same variable for multiple purposes in the same function (CWE-1109), leading to incorrect access control (CWE-284) and expired pointer dereference (CWE-825) • CVE-2008-5013: access of expired memory address leads to arbitrary code execution • CVE-2010-3257: stale pointer issue leads to denial of service and possibly other consequences • CVE-2008-0062: Chain: a message having an unknown message type may cause a reference to uninitialized memory resulting in a null pointer dereference (CWE-476) or dangling pointer (CWE-825), possibly crashing the system or causing heap corruption. • CVE-2007-1211: read of value at an offset into a structure after the offset is no longer valid