CWE-773 is the file descriptor flavor of lost references. The product does not properly maintain references to a file descriptor or handle, which prevents it from being reclaimed.
Servers that open many files or sockets feel this first, because a leak that costs one descriptor per request adds up fast.
How it happens
Code opens a file or socket and then overwrites the variable holding it, or returns early without passing it on. The descriptor stays open in the process, but no code path can close it.
What an attacker gains
Availability, per the record. The product can consume all available file descriptors or handles, which prevents other processes from doing critical file work. An attacker who can trigger the leaking path repeatedly turns a slow leak into an outage.
How to find it
MITRE says static analysis can find some instances. Dynamic checks are simpler: watch the open descriptor count of a running process under load. On Linux, listing the process's open files before and after a batch of requests shows a leak clearly.
How to fix it
- Keep a reference to every descriptor until it is closed, and close it on every path, including errors.
- Use the limits your platform gives you. MITRE names setrlimit() and getrlimit() on POSIX systems.
- When usage nears the cap, restrict further allocation to privileged users, or start releasing descriptors held for less privileged ones.
- Check for failure when a descriptor cannot be allocated.
Quick check
What is the quickest symptom of a descriptor leak?
The process's open descriptor count rises with traffic and never falls back, until opens start failing.
