CWE-911 Improper Update of Reference Count: What Goes Wrong

CWE-911, Improper Update of Reference Count, covers products that use a reference count to manage a resource but fail to update it, or update it wrongly. It shows up in operating system kernels, drivers and any C or C++ code with shared objects.

How it happens

A reference count tracks how many holders use a resource. At zero, the resource is freed or reused. Two failures follow:

• The count reaches zero too early. The resource is released while something still uses it.
• The count never reaches zero. The resource is never released.

The examples MITRE lists show the usual causes. In CVE-2002-0574 (details) a count was not decremented, leaking memory in an OS when ICMP packets arrived. In CVE-2004-0114 a shared memory count was not decremented when a function failed. CVE-2006-3741 led to file descriptor consumption. In CVE-2007-1383, an integer overflow in the counter caused the same variable to be destroyed twice.

Error paths are the classic gap: a function takes a reference, hits an error and returns without releasing it.

What an attacker gains

MITRE rates the main consequence as high impact on availability. An adversary who can make the counter inaccurate can cause resources to leak until they become scarce, which is resource exhaustion. A lower impact is forcing a crash or exit.

How to find it

The MITRE record lists no detection methods. Look for functions with several return paths and check that every one balances the acquire and release calls. Stress tests that repeat an operation many times and watch memory and handle counts will expose leaks.

How to fix it

Formal mitigations are not listed. Practical steps:

1. Route every exit through one cleanup block so release always runs.
2. Use scope based wrappers, such as smart pointers in C++, instead of manual increments.
3. Guard the counter against overflow, since a wrapped count can trigger a double free.

Quick check

Sources

• MITRE CWE-911