Fallos del tipo CWE-911

20 resultados

Atualização Incorreta de Contagem de Referências

Ocorre quando o código não incrementa ou decrementa corretamente o contador de referências de um objeto em memória, levando a cenários onde objetos são liberados prematuramente (use-after-free) ou nunca são liberados (vazamento de memória). Em linguagens com gerenciamento manual ou sistemas que usam reference counting para GC, essa falha causa corrupção de estado ou crashes.

Ejemplo

Um driver de kernel incrementa a referência de um buffer ao adicioná-lo a uma fila, mas esquece de decrementá-la após processar: o buffer nunca é liberado. Ou o inverso: decrementa duas vezes e outro thread acessa memória já devolvida ao heap.

Cómo mitigar

Implemente testes com sanitizers (AddressSanitizer, valgrind) para detectar use-after-free e vazamentos; use abstrações seguras como smart pointers (C++) ou linguagens com GC automático quando possível; mantenha padrão claro de quando e onde incrementar/decrementar referências, documentado e revisado em code review.

CVE-2022-1678MEDIUMAn issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns lEPSS 2.9%CVE-2022-37012HIGHThis vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C+EPSS 1.8%CVE-2022-22195HIGHJunos OS Evolved: Specific packets reaching the RE lead to a counter overflow and eventually a crashEPSS 1.1%CVE-2022-29581HIGHImproper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. TEPSS 0.9%CVE-2024-43102CRITICALumtx Kernel panic or Use-After-FreeEPSS 0.7%CVE-2023-22394HIGHJunos OS: SRX Series and MX Series: Memory leak due to receipt of specially crafted SIP calls EPSS 0.6%CVE-2026-42534MEDIUMJostle logic bypass degrades resolution performanceEPSS 0.6%CVE-2026-49419HIGHJail reference count underflowEPSS 0.5%CVE-2026-110753CRITICALText::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getlineEPSS 0.4%CVE-2026-77587MEDIUMTor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set wEPSS 0.4%CVE-2023-2019MEDIUMA flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper manageEPSS 0.3%CVE-2026-46316CRITICALKVM: arm64: vgic-its: Drop the translation cache reference only for the erased entryEPSS 0.3%CVE-2026-52943HIGHnet: skbuff: fix missing zerocopy reference in pskb_carve helpersEPSS 0.3%CVE-2026-46099HIGHnet: ipv6: fix NOREF dst use in seg6 and rpl lwtunnelsEPSS 0.3%CVE-2023-5633HIGHKernel: vmwgfx: reference count issue leads to use-after-free in surface handlingEPSS 0.3%CVE-2024-45783MEDIUMGrub2: fs/hfs+: refcount can be decremented twiceEPSS 0.3%CVE-2021-47327HIGHiommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get failsEPSS 0.3%CVE-2020-11935MEDIUMaufs: improperly managed inode reference counts in the vfsub_dentry_open() methodEPSS 0.2%CVE-2026-19380MEDIUMMullvad wireguard.sys IOCTL AdapterState reference countEPSS 0.2%CVE-2024-46972HIGHGPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fenceEPSS 0.2%