Fallos del tipo CWE-911

19 resultados

Atualização Incorreta de Contagem de Referências

Ocorre quando o código não incrementa ou decrementa corretamente o contador de referências de um objeto em memória, levando a cenários onde objetos são liberados prematuramente (use-after-free) ou nunca são liberados (vazamento de memória). Em linguagens com gerenciamento manual ou sistemas que usam reference counting para GC, essa falha causa corrupção de estado ou crashes.

Ejemplo

Um driver de kernel incrementa a referência de um buffer ao adicioná-lo a uma fila, mas esquece de decrementá-la após processar: o buffer nunca é liberado. Ou o inverso: decrementa duas vezes e outro thread acessa memória já devolvida ao heap.

Cómo mitigar

Implemente testes com sanitizers (AddressSanitizer, valgrind) para detectar use-after-free e vazamentos; use abstrações seguras como smart pointers (C++) ou linguagens com GC automático quando possível; mantenha padrão claro de quando e onde incrementar/decrementar referências, documentado e revisado em code review.

CVE-2022-1678MEDIUMAn issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns lEPSS 2.9%CVE-2022-37012HIGHThis vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C+EPSS 1.8%CVE-2022-22195HIGHJunos OS Evolved: Specific packets reaching the RE lead to a counter overflow and eventually a crashEPSS 1.1%CVE-2022-29581HIGHImproper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. TEPSS 0.9%CVE-2026-42534MEDIUMJostle logic bypass degrades resolution performanceEPSS 0.7%CVE-2024-43102CRITICALumtx Kernel panic or Use-After-FreeEPSS 0.7%CVE-2023-22394HIGHJunos OS: SRX Series and MX Series: Memory leak due to receipt of specially crafted SIP calls EPSS 0.6%CVE-2026-49419HIGHJail reference count underflowEPSS 0.5%CVE-2026-46099HIGHnet: ipv6: fix NOREF dst use in seg6 and rpl lwtunnelsEPSS 0.4%CVE-2026-77587MEDIUMTor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set wEPSS 0.4%CVE-2023-2019MEDIUMA flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper manageEPSS 0.3%CVE-2023-5633HIGHKernel: vmwgfx: reference count issue leads to use-after-free in surface handlingEPSS 0.3%CVE-2021-47327HIGHiommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get failsEPSS 0.3%CVE-2024-45783MEDIUMGrub2: fs/hfs+: refcount can be decremented twiceEPSS 0.2%CVE-2026-46316CRITICALKVM: arm64: vgic-its: Drop the translation cache reference only for the erased entryEPSS 0.2%CVE-2020-11935MEDIUMaufs: improperly managed inode reference counts in the vfsub_dentry_open() methodEPSS 0.2%CVE-2026-52943HIGHnet: skbuff: fix missing zerocopy reference in pskb_carve helpersEPSS 0.2%CVE-2026-19380MEDIUMMullvad wireguard.sys IOCTL AdapterState reference countEPSS 0.2%CVE-2024-46972HIGHGPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fenceEPSS 0.2%