Some things belong only to your program: an open file, a socket, a handle. CWE-402 is the class for a product that makes resources available to untrusted parties when those resources are only intended to be accessed by the product. MITRE's title calls it a resource leak, as in a resource leaking out of its intended sphere of control.
It is a broad class entry. Its best known child is the file descriptor leak, covered by CWE-403.
How it happens
A resource created inside a trusted context is passed, inherited or exposed to a context with less trust. The record points to two real cases:
- CVE-2003-0740: a server leaks a privileged file descriptor, allowing the server to be hijacked.
- CVE-2004-1033: a file descriptor leak allows reading of restricted files.
In both, the resource was already open and powerful. Whoever received it did not need to pass any access check.
What an attacker gains
MITRE lists confidentiality: reading application data. With a leaked handle the attacker may read what the product could read, without having the privileges to open it themselves.
How to find it
MITRE says automated static analysis (SAST) can find some instances. Review any place your code spawns a child process, hands a handle to a plugin or exposes an object across a trust boundary, and ask what the receiver inherits.
How to fix it
The record lists no mitigations. The following practices follow directly from the definition:
- Create resources with the narrowest sharing allowed, and close them before crossing into less trusted code.
- Mark handles non-inheritable by default where the platform supports it.
- Drop privileges before running less trusted code, and do not let that code run in the same process where you can avoid it.
Quick check
How is CWE-402 related to CWE-403?
CWE-402 is the general class of private resources leaking to untrusted parties. CWE-403 is the specific case of file descriptors inherited by child processes.
