CWEweakness
CWE-910 Use of Expired File Descriptor
Medium
Official page ↗
- Alternate terms
- Stale file descriptor
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Likelihood of exploit
- Medium
- Languages
- C, C++, Not Language-Specific
- CWE version
- 5.0
Description
The product uses or accesses a file descriptor after it has been closed.
Common consequences
• Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories — The reused file descriptor might reference a different file or device than the original file descriptor. As a result, the program could read data from, or write data to, the wrong file.
• Availability: DoS: Crash, Exit, or Restart — Accessing a file descriptor that has been closed can cause a crash.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Related
Child of · CWE (1)
- CWE-672 Operation on a Resource after Expiration or Release weakness
Referenced by CVE · weakness (2)
- CVE-2026-47478 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor. vulnerability
- CVE-2020-13530 A denial-of-service vulnerability exists in the Ethernet/IP server functionality of the EIP Stack Group OpENer 2.3 and development commit… vulnerability