CWE-404: Improper Resource Shutdown or Release

ClassDraftExploit Likelihood: Medium

The product does not release or incorrectly releases a resource before it is made available for re-use.

View on MITRE
Back to CWE Lookup

Extended Description

When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.

Technical Details

Structure
Simple

Applicable To

Languages
Not Language-Specific
Platforms

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine analysis methods around the CWE-404 resource boundary

MITRE identifies automated static analysis, manual source review, dynamic analysis as applicable detection approaches. Use them to trace ownership of memory, handles, locks, sessions, transactions, and kernel objects through success, failure, cancellation, timeout, and partial-initialization paths until exactly one release is guaranteed. Require a reproducible trace from attacker influence to the unsafe behavior, record coverage gaps, and confirm suspected findings dynamically where safe; no single technique establishes complete coverage.

CWE-404: detection methods and operational guidanceMITRE CWE

Bind resource release to scope and explicit ownership

Use scoped resource handles and RAII so cleanup follows lifetime automatically. Give each resource one documented owner, transfer ownership explicitly, and make teardown safe after partial initialization. In manual environments, consolidate cleanup and cover early return, exception, timeout, cancellation, retry, and shutdown paths without double-closing or continuing to use a released object.

C++ Core Guidelines: Resource managementStandard C++ Foundation

Apply lessons from CVE-2018-8639 in Microsoft Windows Win32k

NVD maps CVE-2018-8639 to CWE-404; improper shutdown or release of a kernel resource could allow a local authenticated attacker to elevate privileges. Use the case to treat teardown defects as security issues, stress object lifetime across error and concurrent paths, and verify released kernel state cannot be reused through a stale reference.

CVE-2018-8639 DetailNIST National Vulnerability Database

Apply CERT MEM31-C to every dynamically allocated object

Use MEM31-C as the minimum ownership rule for dynamic memory and extend the same discipline to descriptors, locks, transactions, sessions, and kernel objects. Document the responsible owner and terminal release point, prohibit ambiguous shared ownership, and verify cleanup remains correct when initialization stops midway or an operation exits abnormally.

SEI CERT C Memory Management RulesCarnegie Mellon SEI

Exercise teardown paths under Memcheck and failure injection

Run repeated success and forced-failure workloads under Memcheck or platform-equivalent resource instrumentation. Inject failures after each acquisition, cancel concurrent work, trigger timeouts, reconnect, and stop services under load. Track leaked, invalidly released, and still-referenced resources, and assert that handles, locks, transactions, and memory return to baseline after work completes.

Valgrind Memcheck ManualValgrind Developers

Frequently Asked Questions

What is CWE-404: Improper Resource Shutdown or Release?+

CWE-404: Improper Resource Shutdown or Release is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product does not release or incorrectly releases a resource before it is made available for re-use. When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.

What are the security consequences of Improper Resource Shutdown or Release?+

If exploited, CWE-404 (Improper Resource Shutdown or Release) it can compromise Availability, Other and Confidentiality, leading to outcomes such as DoS: Resource Consumption (Other), Varies by Context and Read Application Data.

How do you prevent or mitigate Improper Resource Shutdown or Release?+

Recommended mitigations for CWE-404 include: It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions. Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[]. When releasing a complex object or structure, ensure that you properly dispose of all of its member components, not just the object itself.

Which programming languages are affected by Improper Resource Shutdown or Release?+

CWE-404 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Improper Resource Shutdown or Release?+

MITRE documents real CVEs mapped to CWE-404, including CVE-1999-1127, CVE-2001-0830 and CVE-2002-1372. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-404 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More

Advertisement