{"@ID": "911", "@Name": "Improper Update of Reference Count", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "664", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "CanPrecede", "@CWE_ID": "672", "@View_ID": "1000"}, {"@Nature": "CanPrecede", "@CWE_ID": "772", "@View_ID": "1000"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": [{"@Name": "C", "@Prevalence": "Sometimes"}, {"@Name": "C++", "@Prevalence": "Sometimes"}, {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}]}, "Background_Details": {"Background_Detail": "Reference counts can be used when tracking how many objects contain a reference to a particular resource, such as in memory management or garbage collection. When the reference count reaches zero, the resource can be de-allocated or reused because there are no more objects that use it."}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Likelihood_Of_Exploit": "Medium", "Common_Consequences": {"Consequence": [{"Scope": "Availability", "Impact": ["DoS: Resource Consumption (Memory)", "DoS: Resource Consumption (Other)"], "Likelihood": "High", "Note": "If an adversary can prevent a reference count from reaching zero, then resources might not be released when they are supposed to, thus causing resources to become scarce for future needs."}, {"Scope": "Availability", "Impact": "DoS: Crash, Exit, or Restart", "Likelihood": "Low", "Note": "If an adversary can cause a reference count to reach zero when the resource is still in use, then a resource might be released before it is supposed to be, possibly forcing an error that causes the product to crash or exit out of its current operation."}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2002-0574", "Description": "Chain: reference count is not decremented, leading to memory leak in OS by sending ICMP packets.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-0574"}, {"Reference": "CVE-2004-0114", "Description": "Reference count for shared memory not decremented when a function fails, potentially allowing unprivileged users to read kernel memory.", "Link": "https://www.cve.org/CVERecord?id=CVE-2004-0114"}, {"Reference": "CVE-2006-3741", "Description": "Chain: improper reference count tracking leads to file descriptor consumption", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-3741"}, {"Reference": "CVE-2007-1383", "Description": "Chain: integer overflow in reference counter causes the same variable to be destroyed twice.", "Link": "https://www.cve.org/CVERecord?id=CVE-2007-1383"}, {"Reference": "CVE-2007-1700", "Description": "Incorrect reference count calculation leads to improper object destruction and code execution.", "Link": "https://www.cve.org/CVERecord?id=CVE-2007-1700"}, {"Reference": "CVE-2008-2136", "Description": "Chain: incorrect update of reference count leads to memory leak.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-2136"}, {"Reference": "CVE-2008-2785", "Description": "chain/composite: use of incorrect data type for a reference counter allows an overflow of the counter, leading to a free of memory that is still in use.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-2785"}, {"Reference": "CVE-2008-5410", "Description": "Improper reference counting leads to failure of cryptographic operations.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-5410"}, {"Reference": "CVE-2009-1709", "Description": "Chain: improper reference counting in a garbage collection routine leads to use-after-free", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-1709"}, {"Reference": "CVE-2009-3553", "Description": "Chain: reference count not correctly maintained when client disconnects during a large operation, leading to a use-after-free.", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-3553"}, {"Reference": "CVE-2009-3624", "Description": "Reference count not always incremented, leading to crash or code execution.", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-3624"}, {"Reference": "CVE-2010-0176", "Description": "improper reference counting leads to expired pointer dereference.", "Link": "https://www.cve.org/CVERecord?id=CVE-2010-0176"}, {"Reference": "CVE-2010-0623", "Description": "OS kernel increments reference count twice but only decrements once, leading to resource consumption and crash.", "Link": "https://www.cve.org/CVERecord?id=CVE-2010-0623"}, {"Reference": "CVE-2010-2549", "Description": "OS kernel driver allows code execution", "Link": "https://www.cve.org/CVERecord?id=CVE-2010-2549"}, {"Reference": "CVE-2010-4593", "Description": "improper reference counting leads to exhaustion of IP addresses", "Link": "https://www.cve.org/CVERecord?id=CVE-2010-4593"}, {"Reference": "CVE-2011-0695", "Description": "Race condition causes reference counter to be decremented prematurely, leading to the destruction of still-active object and an invalid pointer dereference.", "Link": "https://www.cve.org/CVERecord?id=CVE-2011-0695"}, {"Reference": "CVE-2012-4787", "Description": "improper reference counting leads to use-after-free", "Link": "https://www.cve.org/CVERecord?id=CVE-2012-4787"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-884"}}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2012-12-21", "Submission_Version": "2.4", "Submission_ReleaseDate": "2013-02-21"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-06-20", "Modification_Version": "3.3", "Modification_ReleaseDate": "2019-06-20", "Modification_Comment": "updated Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships, Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-04-03", "Modification_Version": "4.17", "Modification_ReleaseDate": "2025-04-03", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Background_Details, Common_Consequences, Description"}]}, "entry_type": "Weakness"}