CWE-774 covers products that allocate file descriptors or handles on behalf of an actor without restricting how many that actor can get. It is a specific case of the broader CWE-770.
Network services and anything that accepts uploads or opens files for users are the main targets.
How it happens
Each connection, upload or request opens a descriptor. If nothing caps the number per user or per process, a single client can open thousands and keep them open.
What an attacker gains
The record lists availability. All descriptors get consumed, and other processes cannot perform critical file operations. No code execution is needed, only patience and a script.
How to find it
Static analysis can find some cases, according to MITRE. A quick practical test is to open many connections from one client against a staging copy and see whether the service keeps answering others.
How to fix it
- Use resource limits from the operating system or environment. MITRE names setrlimit() and getrlimit() on POSIX.
- Set per user and per connection caps in the application too, so one actor cannot take the whole pool.
- As usage approaches the maximum, limit further allocation to privileged users, or release descriptors held by less privileged ones.
- Handle allocation failures with proper error checks.
Quick check
Why is a process-wide limit alone not enough?
It protects the system but not your other users. One client can still use up the whole allowance, so add per client caps.
