Back to Vulnerability Database

Use After Free

Description

Use After Free (UAF) is a vulnerability that occurs when software continues to use a pointer after the memory it references has been freed. Once memory is freed, it may be reallocated for other purposes. If the dangling pointer is subsequently dereferenced, the program may read or write to memory now used for different data structures, leading to data corruption, information disclosure, or code execution. Use-after-free vulnerabilities are particularly prevalent in complex applications with manual memory management, including browsers, document parsers, and operating system kernels.

Risk

Use-after-free vulnerabilities are highly exploitable and consistently rank among the most dangerous software weaknesses. Attackers leverage heap manipulation techniques to control what data occupies the freed memory when the dangling pointer is dereferenced. By placing attacker-controlled objects (containing function pointers or vtables) in the freed space, code execution is achieved when the stale pointer is used. Browsers are frequent targets due to complex JavaScript/DOM interactions that create race conditions and memory management errors. UAF bugs have enabled numerous browser-based attacks, privilege escalation exploits, and malware campaigns.

Solution

Implement strict ownership semantics and lifecycle management for allocated memory. Use smart pointers (std::unique_ptr, std::shared_ptr in C++) that automatically manage memory and prevent dangling references. Set pointers to NULL immediately after freeing. Use memory-safe languages (Rust with ownership system, Go with garbage collection). Enable AddressSanitizer during development to detect UAF. Implement reference counting for shared objects. Avoid storing raw pointers to heap objects when possible. Conduct thorough code review of memory allocation/deallocation patterns.

Common Consequences

ImpactDetails
Access ControlScope: Code Execution

Attackers place malicious objects in freed memory; dereferencing corrupted vtables or function pointers enables arbitrary code execution.
IntegrityScope: Integrity

Writing through dangling pointers corrupts unrelated data structures now occupying the freed memory.
ConfidentialityScope: Confidentiality

Reading through dangling pointers may expose sensitive data stored in reallocated memory.

Example Code + Solution Code

Vulnerable Code

// VULNERABLE: Use after free
struct User {
    char *name;
    void (*callback)(void);
};

void vulnerable_function() {
    struct User *user = malloc(sizeof(struct User));
    user->name = strdup("admin");
    user->callback = normal_callback;

    // ... some operations ...

    free(user);  // Memory freed

    // ... more code ...

    // UAF: user pointer still used after free
    user->callback();  // If attacker controlled freed memory, arbitrary execution
}

// VULNERABLE: Double free leading to UAF
void double_free_uaf(char *ptr) {
    free(ptr);
    // ... code that might allocate, reusing ptr's memory ...
    free(ptr);  // Double free - can cause UAF or heap corruption
}

Fixed Code

#include <stdlib.h>

// SAFE: Nullify pointer after free
void safe_function() {
    struct User *user = malloc(sizeof(struct User));
    if (!user) return;

    user->name = strdup("admin");
    user->callback = normal_callback;

    // Proper cleanup
    free(user->name);
    user->name = NULL;
    free(user);
    user = NULL;  // Prevent use after free

    // Any subsequent use of user will be NULL dereference (crash, not exploit)
}

// SAFE: Using reference counting
struct RefCountedUser {
    int ref_count;
    char *name;
};

void release_user(struct RefCountedUser **user_ptr) {
    if (*user_ptr && --(*user_ptr)->ref_count == 0) {
        free((*user_ptr)->name);
        free(*user_ptr);
    }
    *user_ptr = NULL;
}

// BEST: C++ smart pointers
#include <memory>

class User {
public:
    std::string name;
    std::function<void()> callback;
};

void safe_cpp_function() {
    auto user = std::make_unique<User>();
    user->name = "admin";

    // unique_ptr automatically freed when out of scope
    // No dangling pointer possible
}

Exploited in the Wild

Chrome Zero-Days (Chrome, Ongoing)

Multiple use-after-free vulnerabilities in Chrome have been exploited in the wild, including CVE-2022-0609, CVE-2022-1096, and CVE-2022-2294. These bugs in various Chrome components enabled remote code execution through malicious web pages.

Windows Win32k UAF (Windows, Multiple)

CVE-2021-1732 and numerous other use-after-free vulnerabilities in Windows win32k kernel component have been exploited for local privilege escalation by APT groups and ransomware operators.

Tools to test/exploit

  • AddressSanitizer — runtime UAF detection with detailed reports.

  • Valgrind — detects use of freed memory.

  • UBSan — undefined behavior sanitizer catching UAF patterns.

CVE Examples

References

  1. MITRE. "CWE-416: Use After Free." https://cwe.mitre.org/data/definitions/416.html

  2. Project Zero. "A very deep dive into iOS Exploit chains." https://googleprojectzero.blogspot.com/