CWE-675 is a product performing the same operation on a resource two or more times when it should be applied only once. Double close, double unlock and double decode are the usual forms. It shows up in systems code, input filters and anything with cleanup paths.
How it happens
The record lists three examples.
- CVE-2009-0935: an attacker provides an invalid address to a memory-reading function, causing a mutex to be unlocked twice.
- CVE-2019-13351: a file descriptor double close can cause the wrong file to be associated with a file descriptor.
- CVE-2004-1939: an XSS protection mechanism attempts to remove a slash that could be used to close tags, but it can be bypassed using double encoded slashes.
The file descriptor case is easy to picture. The number is closed once, then reused for a different file, and the second close hits the new file.
/* Vulnerable: fd is closed in the error path and again in cleanup */
int fd = open(path, O_RDONLY);
if (read_header(fd) < 0) {
close(fd);
goto cleanup;
}
cleanup:
close(fd); /* second close, may hit a different file now */
The XSS case runs in the other direction. A filter decodes input once and assumes the job is done, so input encoded twice survives.
What an attacker gains
The record lists the consequence as "Other". The examples show the range: corrupted lock state, operations on the wrong file, and a bypassed security filter.
How to find it
The record lists no detection methods. Trace each release or decode step and check whether any other path performs it again. Review cleanup labels and error handlers closely. Test filters with doubly encoded input.
How to fix it
MITRE lists no formal mitigations on this entry. Practical steps:
- Set a handle to an invalid value right after closing, and check it before closing again.
- Put release in one place per resource.
- For decoding and sanitizing, apply the operation once at a well defined point, and compare against the canonical form afterward.
close(fd);
fd = -1;
/* cleanup */
if (fd >= 0) close(fd);
Quick check
Why is a double close dangerous?
The first close frees the number for reuse. The second may then close an unrelated file.
